Rafael Felipe
12/10/2025, 8:13 PMkapa.ai
12/10/2025, 8:13 PM10.25.40.71:27017 (e.g., via `ping`/`telnet`/`nc` from the same network or container). A similar timeout/connection issue was traced back to basic connectivity problems in another MongoDB case.[[Salesforce & Mongo sync](https://discuss.airbyte.io/t/737)] 2. TLS/SSL configuration mismatch - The error SSLHandshakeException: Remote host terminated the handshake plus EOFException: SSL peer shut down incorrectly strongly suggests a TLS mismatch: - MongoDB may require TLS, but the Airbyte MongoDB source is trying to connect without TLS, or - MongoDB may be non‑TLS, but the Airbyte source is trying to connect with TLS, or - The server is using a self‑signed / internal CA certificate that the connector does not trust, which has been seen with Amazon DocumentDB and local TLS clusters.[[Self-signed cert](https://discuss.airbyte.io/t/983); [Mongo SSLHandshake](https://github.com/airbytehq/airbyte/issues/49934)] Given the knowledge sources, I can’t see your exact Airbyte MongoDB source configuration, so I can’t say precisely which of these applies, but you can systematically check: - Verify on the MongoDB side: - Whether TLS is enabled (net.tls.mode / --tlsMode, --sslMode) and if it is requireTLS, allowTLS, or disabled. - Align the Airbyte MongoDB source settings with that: - If MongoDB requires TLS, ensure the Airbyte source is configured to use TLS/SSL. - If MongoDB does not use TLS, disable TLS/SSL in the Airbyte source. - If you are using self‑signed or internal CA certificates (including DocumentDB‑like setups), be aware that the current connectors in the examples do not automatically trust custom CAs; connection failures with PKIX path building failed or handshake termination are expected until the connector is extended to use the appropriate CA bundle.[[Self-signed cert](https://discuss.airbyte.io/t/983); [Mongo SSLHandshake](https://github.com/airbytehq/airbyte/issues/49934)] If, after confirming network reachability and matching TLS settings, the error persists, the knowledge sources suggest that additional connector support for custom CAs or more advanced TLS options may be required, but they do not provide a definitive built‑in workaround.