# TLS with Atlas
Atlas only accepts TLS connections. The drivers enable TLS automatically when you use the `mongodb+srv://` string. Problems start when agents fight the TLS layer.
## Rules
- Never set `tlsAllowInvalidCertificates=true` (or `tlsInsecure`) to make a cert error go away. It disables hostname verification and invites man-in-the-middle. Fix the trust chain instead.
- `tls: first record does not look like a TLS handshake` means the client tried plaintext against a TLS-only endpoint. You probably forced `tls=false` or used a `mongodb://` string without `ssl=true`. Remove the override.
- `certificate verify failed` on Linux usually means a missing or outdated CA bundle, common in minimal containers. Install the distro CA certificates package, or point the driver at a CA file (`tlsCAFile` in most drivers). Do not disable verification.
- Corporate proxies that MITM TLS need their root CA added to the trust store the driver uses. That is an environment fix, not a driver flag.
- Keep drivers reasonably current. Old drivers ship old TLS defaults and old CA handling.
## Verify
Connect with default TLS settings from the deploy environment. If the handshake succeeds there, any failure elsewhere is environmental (proxy, CA bundle, stale image), not Atlas.