DOCS-393 added info about arbiters and encryption

Author: Bob Grabar

source/core/replication.txt

@@ -164,6 +164,16 @@ participate in :term:`elections <election>`.
    Do not run arbiter processes on a system that is an active
    :term:`primary` or :term:`secondary` of its replica set.
 
+You must run arbiters only on secure networks. While arbiters do not
+hold database content, they do hold replica-set configuration data,
+which always should be protected. Arbiters use encryption only when
+creating a connection with another replica-set member. All other
+communications are unencrypted.
+
+.. warning::
+
+   Never run an arbiter on a non-secure network.
+
 .. index:: replica set members; non-voting
 .. _replica-set-non-voting-members:
 

source/faq/replica-sets.txt

@@ -181,6 +181,22 @@ primary.
 
 .. seealso:: :doc:`/administration/replication-architectures`
 
+Do arbiters use encrypted communication?
+----------------------------------------
+
+Arbiters use encryption only when creating a connection with another
+replica-set member. All other communications are unencrypted.
+
+The following rules govern arbiter communications:
+
+- An arbiter is authenticated when a connection is created between it
+  and another member of the replica set. The arbiter is then trusted
+  until the connection ends.
+
+- Replica set configuration data and voting are unencrypted.
+
+You must always run arbiters on secure networks.
+
 Which members of a replica set vote in elections?
 -------------------------------------------------