mongodb connector (self-managed) error:

Connector configuration is not valid. Unable to connect: Timed out after 30000 ms while waiting for a server that matches ReadPreferenceServerSelector{readPreference=primary}. Client view of cluster state is {type=UNKNOWN, servers=[{address=X, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketWriteException: Exception sending message}, caused by {javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake}, caused by {java.io.EOFException: SSL peer shut down incorrectly

That error indicates the MongoDB TLS/SSL handshake is failing; the server is closing the connection during SSL negotiation, so the MongoDB driver never sees a healthy primary and times out. The same pattern appears in other MongoDB and DocumentDB reports with

MongoSocketWriteException

and

SSLHandshakeException

/

PKIX path building failed

/ “remote host terminated the handshake”.[[Self-signed certs](https://discuss.airbyte.com/t/983); [Local Mongo SSLHandshake](https://github.com/airbytehq/airbyte/issues/49934)] From the available docs and issues, here are the relevant constraints and checks: 1. TLS/SSL is mandatory for the MongoDB v2 connector - The connector requires TLS/SSL; it is not optional.[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] - For self‑hosted MongoDB, you must configure TLS correctly on the database side according to MongoDB’s docs.[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] 2. Custom / self‑signed CAs are not supported in some cases - Airbyte does not support self‑signed certificates for SSH tunnels with MongoDB.[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] - The MongoDB connector does not support custom SSL certificates required by AWS DocumentDB; this leads to similar

PKIX

/ handshake errors.[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations); [Self-signed certs](https://discuss.airbyte.com/t/983)] This strongly suggests that if your self‑managed MongoDB is using an internal CA / self‑signed cert that is not in the default Java truststore, the connector will fail with handshake errors. 3. Known behavior with self‑signed or local TLS setups - A local replica set configured with TLS (using local

.pem

files) produced the same

MongoSocketWriteException

/

SSLHandshakeException: Remote host terminated the handshake

and timeouts when used with the MongoDB source connector, even when adding parameters like

ssl=true

and

directConnection=false

to the connection string.[[Local Mongo SSLHandshake](https://github.com/airbytehq/airbyte/issues/49934)] Given this, the most likely causes for your error are: - The MongoDB server expects/negotiates TLS, but the connector either: - is not connecting with TLS as the server expects (mode mismatch like `allowTLS`/`requireTLS` vs client config), or - cannot validate the server certificate because it’s self‑signed or signed by an internal CA not trusted by the Java runtime inside the connector. Because the docs do not document a way to provide a custom CA or truststore to the MongoDB connector, and explicitly mention that self‑signed/custom cert scenarios are unsupported in some environments, there is no documented, supported workaround for arbitrary internal CAs in self‑managed MongoDB beyond using certificates trusted by the default Java CA set.[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations); [Self-signed certs](https://discuss.airbyte.com/t/983)] What you can verify / adjust (within documented limits): - Ensure your MongoDB cluster is a replica set (standalone nodes are not supported).[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] - Confirm that: - TLS is enabled on MongoDB as required. - The certificate presented by MongoDB is issued by a CA trusted by standard Java truststores (i.e., not a purely private CA unless you have made it trusted at the container/host level for Airbyte; this trust configuration is not documented by Airbyte). - If you’re using SSH tunneling plus self‑signed certs, be aware this combination is explicitly not supported.[[MongoDB v2 limits](https://docs.airbyte.com/integrations/sources/mongodb-v2/mongodb-v2-troubleshooting#connector-limitations)] If your setup requires a self‑signed or internal‑CA certificate that is not globally trusted, the knowledge sources do not describe an official way to make the MongoDB connector trust that certificate, and similar issues have been closed without a documented fix beyond changing the TLS/cert setup.