MongoNetworkError: failed to connect to server [amazonaws.com:27017] on first connect [Error: unable to get local issuer certificate

Question

I have my mongo details in Apache config file. And getting this error.

SetEnv MONGO_URL mongodb://:@XXXXXXXXX.docdb.amazonaws.com:27017/?ssl=true&ssl_ca_certs=/home/ec2-user/rds-combined-ca-bundle.pem&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false

        App 2291 output: MongoNetworkError: failed to connect to server [XXXXXX.docdb.amazonaws.com:27017] on first connect [Error: unable to get local issuer certificate
        App 2291 output:     at TLSSocket.onConnectSecure (_tls_wrap.js:1474:34)
        App 2291 output:     at TLSSocket.emit (events.js:310:20)
        App 2291 output:     at TLSSocket.EventEmitter.emit (domain.js:482:12)
        App 2291 output:     at TLSSocket._finishInit (_tls_wrap.js:917:8)
        App 2291 output:     at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:687:12) {
        App 2291 output:   name: 'MongoNetworkError',
        App 2291 output:   [Symbol(mongoErrorContextSymbol)]: {}
        App 2291 output: }]

MongoNetworkError: [Error: unable to get local issuer certificate

Hi Yaseen, are you using SSH tunneling or is your application connecting from a client inside the VPC? If you are connecting from outside your VPC with SSH tunneling, you can not set the replicaSet and readPreference for DocumentDB — meet-bhagdev
Both EC2 & DB are in same vpc. SSH is working fine. This is happening when I try using a meteor app & setting DB from apache or nginx env var — Yaseen Shaik

Yaseen Shaik Yaseen Shaik · Accepted Answer · 2020-05-05T16:40:36

It is fixed. I am supposed to use tls=true&tlsCAFile=/var/www/covidapp/rds-combined-ca-bundle.pem instead of ssl=true&ssl_ca_certs=/var/www/medapp/rds-combined-ca-bundle.pem

https://developer.mongodb.com/community/forums/t/mongonetworkerror-unable-to-get-local-issuer-certificate/3518/3

MongoNetworkError: failed to connect to server [amazonaws.com:27017] on first connect [Error: unable to get local issuer certificate

2 Answers