You need to provide the Server CA certificate in the connection string
uri = "mongodb+srv://admin:<password>@cluster0.hkzvmvh.mongodb.net/?retryWrites=true&w=majority&tlsCAFile=isrgrootx1.pem"
You can download the files from https://letsencrypt.org/certificates/
I think it is this one: https://letsencrypt.org/certs/isrgrootx1.pem
Update in October 2024
I got announcement that certificates will move from Let's Encrypt to Google Trust Services. So, in future you may need to change the CA. I did not find this announcement on public internet yet. For me it is not 100% clear whether this change applies also when you run your MongoDB cluster on AWS.
Dear Wernfried,
This email is sent to you because you have an Atlas dedicated cluster
deployed in Azure or Google Cloud. We are changing how MongoDB manages
TLS certificates for Atlas clusters to ensure high-quality service
with improved availability, sustainability and scalability. The
following change will not incur any additional charges and will
require little or no action for most customers.
MongoDB Atlas requires Transport Layer Security (TLS) encryption for
customer data and intra-cluster network communications. MongoDB Atlas
uses Let's Encrypt as the Certificate Authority (CA) for TLS
certificates for all clusters. To improve availability, we are adding
Google Trust Services as an additional CA for Atlas clusters.
By June 2025, ensure "GTS Root R1" and "GTS Root R2", under the "Root
CAs" section in Google Trust Services, are included in your trust
stores on application servers that connect to Atlas clusters to ensure
seamless service continuity. MongoDB does not recommend hardcoding or
pinning intermediate CAs in your application; please refer to the best
practices recommended by MongoDB here and Google Trust Services here.
If Google Trust Services CAs are not included in your trust store, we
recommend upgrading to a newer operating system or version of your
programming language. If you cannot upgrade or are using a custom
trust store, then you will need to manually add Google Trust Services
to your trust store.