@kapa.ai How can we automatically install or prompt the TLS certificate for a source database when it is missing? FiveTran provides a prompt to review and trust the source TLS certificate during connection setup. Without adding TLS certificate, certain database instances that require custom TLS certificates won't be able to connect. I am not able to connect to XAP MongoDB connector, where the connection fails because the required TLS certificate is not present in the Airbyte JVM trust store. Attached screenshot - I can see the TLS certificates from server during the SSL handshake using below command.

Sorry @Rahul, it looks like your question contains files, which I cannot process. Please reformulate your question without including any files.

@kapa.ai How can we automatically install or prompt the TLS certificate for a source database when it is missing? FiveTran provides a prompt to review and trust the source TLS certificate during connection setup. Without adding TLS certificate, certain database instances that require custom TLS certificates won't be able to connect. I am not able to connect to XAP MongoDB connector, where the connection fails because the required TLS certificate is not present in the Airbyte JVM trust store. Attached screenshot - I can see the TLS certificates from server during the SSL handshake using below command.

Airbyte does not currently have a built‑in flow like Fivetran’s “prompt to review and trust certificate” for sources whose TLS/SSL certs are not in the default JVM trust store. From the available information: - Most database connectors do not let you provide custom CA / TLS certificates via the UI today.[[Self-signed certs](https://discuss.airbyte.io/t/983)] - For MongoDB and Elasticsearch specifically, there are no official instructions for loading arbitrary custom certificates into the connector images; this is on the backlog and not a high‑priority item.[[Loading certificates](https://discuss.airbyte.io/t/2501)] - Self‑hosted MongoDB with self‑signed certificates over SSH tunnels is explicitly not supported.[[MongoDB limitations](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] - The MongoDB v2 connector added special‑case support for Amazon DocumentDB by baking the AWS CA certs directly into the connector image, not by prompting the user or supporting arbitrary cert upload.[[Loading certificates](https://discuss.airbyte.io/t/2501)] For your specific XAP MongoDB connector case (PKIX

unable to find valid certification path

), this falls into the general “custom / internal CA” problem that is not solved generically today. The only documented/worked‑around approaches are: 1. Custom connector image - Users have worked around similar issues (e.g. Elasticsearch) by creating a new Docker image

FROM

the official connector image and copying their CA cert into the JVM trust store inside the container, then using that custom image instead of the standard one.[[Loading certificates](https://discuss.airbyte.io/t/2501)] - A similar pattern would be required for MongoDB/XAP: build a custom

source-mongodb

(or XAP‑specific) image that imports your CA into the Java keystore inside the container. 2. Await product / connector enhancements - Airbyte acknowledges this limitation and has related items in the backlog (support for private / custom CA for sources like MongoDB and Elasticsearch), but there is no documented released feature that automatically installs or prompts for TLS certificates like Fivetran’s flow.[[Self-signed certs](https://discuss.airbyte.io/t/983); [Loading certificates](https://discuss.airbyte.io/t/2501)] Given the current state of the product and docs, there is: - No supported automatic installation of missing TLS certs for arbitrary databases. - No UI prompt to capture and trust a presented certificate during connection setup. - No connector‑level option to upload a custom CA bundle for MongoDB/XAP. If you need this today, the only path indicated by the knowledge sources is to: - Build and run a custom connector image that adds your organization’s CA into the default Java trust store inside the connector container, similar to the Elasticsearch example referenced in the forum.[[Loading certificates](https://discuss.airbyte.io/t/2501)] If you want this as a first‑class feature (prompting and installing certs automatically), the next step would be to open or upvote a GitHub issue describing your use case, or contribute changes to the relevant connector(s). The existing issues around DocumentDB/MongoDB TLS and Elasticsearch private CAs are good references to link when doing so.[[Self-signed certs](https://discuss.airbyte.io/t/983); [Elasticsearch private CA](https://github.com/airbytehq/airbyte/issues/49816)]