diff --git a/frontend/src/metabase/entities/databases/forms.js b/frontend/src/metabase/entities/databases/forms.js
index 8f53dd5ee18d14c9d21a39793591d64ab846cda0..9ac6a6b9a6c516305d84a18c7e60b7f682731097 100644
--- a/frontend/src/metabase/entities/databases/forms.js
+++ b/frontend/src/metabase/entities/databases/forms.js
@@ -206,32 +206,18 @@ function getEngineInfo(engine, details, id) {
   }
 }
 
-function isHiddenField(field, details) {
-  // NOTE: special case to hide tunnel settings if tunnel is disabled
-  const isDisabledTunnelSettingsField =
-    field.name.startsWith("tunnel-") &&
-    field.name !== "tunnel-enabled" &&
-    !details["tunnel-enabled"];
+function shouldShowEngineProvidedField(field, details) {
+  const detailAndValueRequiredToShowField = field["visible-if"];
 
-  // hide the auth settings based on which auth method is selected
-  // private key auth needs tunnel-private-key and tunnel-private-key-passphrase
-  const isTunnelPrivateFieldWithoutProperAuthMethod =
-    field.name.startsWith("tunnel-private-") &&
-    details["tunnel-auth-option"] !== "ssh-key";
+  if (detailAndValueRequiredToShowField) {
+    const [detail, expectedDetailValue] = Object.entries(
+      detailAndValueRequiredToShowField,
+    )[0];
 
-  // username / password auth uses tunnel-pass
-  const isTunnelPassFieldWithoutProperAuthMethod =
-    field.name === "tunnel-pass" && details["tunnel-auth-option"] === "ssh-key";
-
-  // NOTE: special case to hide the SSL cert field if SSL is disabled
-  const isDisabledSslField = field.name === "ssl-cert" && !details["ssl"];
+    return details[detail] === expectedDetailValue;
+  }
 
-  return (
-    isDisabledTunnelSettingsField ||
-    isTunnelPrivateFieldWithoutProperAuthMethod ||
-    isTunnelPassFieldWithoutProperAuthMethod ||
-    isDisabledSslField
-  );
+  return true;
 }
 
 function getDefaultValue(field) {
@@ -257,7 +243,7 @@ function getEngineFormFields(engine, details, id) {
 
   // convert database details-fields to Form fields
   return engineFields
-    .filter(field => !isHiddenField(field, details))
+    .filter(field => shouldShowEngineProvidedField(field, details))
     .map(field => {
       const overrides = DATABASE_DETAIL_OVERRIDES[field.name];
 
diff --git a/modules/drivers/mongo/resources/metabase-plugin.yaml b/modules/drivers/mongo/resources/metabase-plugin.yaml
index aa477999df4d01a25aca9ad6bd5101387a80e753..4cd1b8f5e741e7fec70011361edcce865cab2a28 100644
--- a/modules/drivers/mongo/resources/metabase-plugin.yaml
+++ b/modules/drivers/mongo/resources/metabase-plugin.yaml
@@ -38,6 +38,9 @@ driver:
     - name: ssl-cert
       type: string
       display-name: Server SSL certificate chain
+      visible-if:
+        ssl: true
+
   connection-properties-include-tunnel-config: true
 init:
   - step: load-namespace
diff --git a/src/metabase/driver/mysql.clj b/src/metabase/driver/mysql.clj
index 26969f8dd3cadb0bda05206463214d34aa6ccc4b..303f805b120801b3bd309fa5addbb237bf69172f 100644
--- a/src/metabase/driver/mysql.clj
+++ b/src/metabase/driver/mysql.clj
@@ -79,7 +79,9 @@
   "Server SSL certificate chain, in PEM format."
   {:name         "ssl-cert"
    :display-name (deferred-tru "Server SSL certificate chain")
-   :placeholder  ""})
+   :placeholder  ""
+   :visible-if   {"ssl" true}}
+)
 
 (defmethod driver/connection-properties :mysql
   [_]
diff --git a/src/metabase/util/ssh.clj b/src/metabase/util/ssh.clj
index b0eb5d50b092346dbbda461179b5b2291e065482..66876512973ea870c634b7a1b2df5a17ac31e0c7 100644
--- a/src/metabase/util/ssh.clj
+++ b/src/metabase/util/ssh.clj
@@ -80,36 +80,43 @@
    {:name         "tunnel-host"
     :display-name "SSH tunnel host"
     :placeholder  "What hostname do you use to connect to the SSH tunnel?"
-    :required     true}
+    :required     true
+    :visible-if   {"tunnel-enabled" true}}
    {:name         "tunnel-port"
     :display-name "SSH tunnel port"
     :type         :integer
     :default      22
-    :required     false}
+    :required     false
+    :visible-if   {"tunnel-enabled" true}}
    {:name         "tunnel-user"
     :display-name "SSH tunnel username"
     :placeholder  "What username do you use to login to the SSH tunnel?"
-    :required     true}
+    :required     true
+    :visible-if   {"tunnel-enabled" true}}
    ;; this is entirely a UI flag
    {:name         "tunnel-auth-option"
     :display-name "SSH Authentication"
     :type         :select
     :options      [{:name "SSH Key" :value "ssh-key"}
                    {:name "Password" :value "password"}]
-    :default      "ssh-key"}
+    :default      "ssh-key"
+    :visible-if   {"tunnel-enabled" true}}
    {:name         "tunnel-pass"
     :display-name "SSH tunnel password"
     :type         :password
-    :placeholder  "******"}
+    :placeholder  "******"
+    :visible-if   {"tunnel-auth-option" "password"}}
    {:name         "tunnel-private-key"
     :display-name "SSH private key to connect to the tunnel"
     :type         :string
     :placeholder  "Paste the contents of an ssh private key here"
-    :required     true}
+    :required     true
+    :visible-if   {"tunnel-auth-option" "ssh-key"}}
    {:name         "tunnel-private-key-passphrase"
     :display-name "Passphrase for SSH private key"
     :type         :password
-    :placeholder  "******"}])
+    :placeholder  "******"
+    :visible-if   {"tunnel-auth-option" "ssh-key"}}])
 
 (defn with-tunnel-config
   "Add preferences for ssh tunnels to a drivers :connection-properties"