## TL;DR

Remove the override. - certificate verify failed on Linux usually means a missing or outdated CA bundle, common in minimal containers. Install the distro CA certificates package, or point the driver at a CA file (tlsCAFile in most drivers).

## Steps

1. Atlas only accepts TLS connections. The drivers enable TLS automatically when you use the `mongodb+srv://` string. Problems start when agents fight the TLS layer.

2. - Never set `tlsAllowInvalidCertificates=true` (or `tlsInsecure`) to make a cert error go away. It disables hostname verification and invites man-in-the-middle. Fix the trust chain instead.
- `tls: first record does not look like a TLS handshake` means the client tried plaintext against a TLS-only endpoint. You probably forced `tls=false` or used a `mongodb://` string without `ssl=true`. Remove the override.
- `certificate verify failed` on Linux usually means a missing or outdated CA bundle, common in minimal containers. Install the distro CA certificates package, or point the driver at a CA file (`tlsCAFile` in most drivers). Do not disable verification.
- Corporate proxies that MITM TLS need their root CA added to the trust store the driver uses. That is an environment fix, not a driver flag.
- Keep drivers reasonably current. Old drivers ship old TLS defaults and old CA handling.

## When to use

You are seeing this: Atlas only accepts TLS connections. Use this skill when you run into "MongoDB Atlas: TLS is mandatory, configure it right".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.