MongoDB TLS: SSL routines / certificate error MongoDB Origin: Data OSI layer 6 · Presentation Last updated 5 Nov 2026

MongoServerSelectionError: C0A8:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error (Atlas) / self-signed certificate

The TLS handshake with MongoDB failed — certificate trust, TLS version, or a proxy/IP block.

Exact message you may see SSL routines:ssl3_read_bytes:tlsv1 alert internal errorMongoServerSelectionError: ssl3_read_bytes:tlsv1 alert internal errorMongoNetworkError: SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERRORMongoServerSelectionError: self signed certificateMongoNetworkError: hostname/IP does not match certificate's altnames
Explore the map of this error Full error map →
Seen on: MongoDB Node.js SSL

Meaning

Atlas requires TLS 1.2+. An alert "internal error" often shows the client IP isn't allowed (Atlas access list) or TLS 1.0/1.1 is used. For self-managed servers with private CAs, pass tlsCAFile. "self-signed certificate" means the CA isn't trusted. Don't use tlsAllowInvalidCertificates in production.

Common causes

  • IP not on the Atlas access list (TLS alert internal error)
  • Old OpenSSL/Node with TLS < 1.2
  • Private CA not provided via tlsCAFile
  • Proxy/antivirus intercepting TLS
  • Certificate hostname mismatch

⚡ Quick fix

  1. Check Atlas Network Access first
  2. Update Node/OpenSSL; require TLS 1.2+
  3. Provide tlsCAFile=/path/ca.pem for private CAs

Detailed fix by platform

Linux

  1. openssl s_client -connect cluster0-shard-00-00.abcde.mongodb.net:27017 </dev/null | head

How to diagnose

  1. Alert — Which TLS error?
  2. IP — Allowed?
  3. CA — Trusted?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Data. Errors that are often confused with or caused by this one (click to open):

Atlas: bad auth: Authentication failed — MongoServerError: bad auth : Authentication failed. (Atlas user / special characters in password) (MongoDB)Atlas: bad auth: Auth…BSONObj size is invalid / exceeds maximum document size (16MB) — MongoServerError: BSONObj size: 17825792 (0x1100000) is invalid. Size must be between 0 and 16793600(16MB) (MongoDB)BSONObj size is inval…Can't connect from another host (bindIp 127.0.0.1) — MongoDB: connection refused / timed out from a remote host — mongod bindIp defaults to 127.0.0.1 (MongoDB)Can't connect from an…MongoDB Atlas: connection timed out — IP not whitelisted — MongoServerSelectionError: Could not connect to any servers in your MongoDB Atlas cluster. One common reason is that you're trying to access the database from an IP that isn't whitelisted (MongoDB)MongoDB Atlas: connec…querySrv ENOTFOUND _mongodb._tcp — MongoDB Atlas: Error: querySrv ENOTFOUND _mongodb._tcp.cluster0.abcde.mongodb.net (MongoDB)querySrv ENOTFOUND _m…Sort/Group exceeded memory limit of 100 MB (allowDiskUse) — MongoServerError: Exceeded memory limit for $group, but didn't allow external sort. Pass allowDiskUse:true to opt in (MongoDB)Sort/Group exceeded m…unable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local i…MongoDB T…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.