MongoDB Atlas: TLS is mandatory, configure it right

TLS with Atlas

Atlas only accepts TLS connections. The drivers enable TLS automatically when you use the mongodb+srv:// string. Problems start when agents fight the TLS layer.

Rules

• Never set tlsAllowInvalidCertificates=true (or tlsInsecure) to make a cert error go away. It disables hostname verification and invites man-in-the-middle. Fix the trust chain instead.
• tls: first record does not look like a TLS handshake means the client tried plaintext against a TLS-only endpoint. You probably forced tls=false or used a mongodb:// string without ssl=true. Remove the override.
• certificate verify failed on Linux usually means a missing or outdated CA bundle, common in minimal containers. Install the distro CA certificates package, or point the driver at a CA file (tlsCAFile in most drivers). Do not disable verification.
• Corporate proxies that MITM TLS need their root CA added to the trust store the driver uses. That is an environment fix, not a driver flag.
• Keep drivers reasonably current. Old drivers ship old TLS defaults and old CA handling.

Verify

Connect with default TLS settings from the deploy environment. If the handshake succeeds there, any failure elsewhere is environmental (proxy, CA bundle, stale image), not Atlas.

Atlas TLS requirements and connection troubleshooting verified against https://www.mongodb.com/docs/atlas/troubleshoot-connection/ on 2026-09-26.