5

I'm trying to connect to my shared MongoDB cluster, but I keep receiving the following error: SSL handshake failed: ac-ascvkib-shard-00-02.hkzvmvh.mongodb.net:27017: [WinError 10054] An existing connection was forcibly closed by the remote host.

The exact code I'm using is below:

from pymongo.mongo_client import MongoClient

# I replaced <password> with my own password
uri = "mongodb+srv://admin:<password>@cluster0.hkzvmvh.mongodb.net/?retryWrites=true&w=majority"

# Create a new client and connect to the server
client = MongoClient(uri)

# Send a ping to confirm a successful connection
try:
    client.admin.command('ping')
    print("Pinged your deployment. You successfully connected to MongoDB!")
except Exception as e:
    print(e)

I'm using Python 3.11 and I'm using pymongo==3.11. I'm on a windows machine, and it seems that the error message gets printed multiple times.

1
  • If the remote host forcibly closed the connection, you probably need to look at the logs from that end to see why it did that.
    – Joe
    Commented Jul 30, 2023 at 22:20

5 Answers 5

7

Simply just visit the network access tab from the MongoDBAtlas and add the IP address from the system you are trying to connect with MongoDB. enter image description here

4
  • In principle you are right, however it has nothing to do with the problem in question. Commented Jul 18, 2024 at 19:32
  • Is there documentation for this ? I am quite confused about this, and want to improve my understanding Commented Jul 30, 2024 at 20:49
  • @JasmeetSingh When accessing MongoDB cloud portal, you can see a warning saying about it.
    – Tung
    Commented Jun 28 at 14:57
  • man you're a hero!
    – John Liu
    Commented Jul 19 at 23:27
7

You need to provide the Server CA certificate in the connection string

uri = "mongodb+srv://admin:<password>@cluster0.hkzvmvh.mongodb.net/?retryWrites=true&w=majority&tlsCAFile=isrgrootx1.pem"

You can download the files from https://letsencrypt.org/certificates/

I think it is this one: https://letsencrypt.org/certs/isrgrootx1.pem

Update in October 2024

I got announcement that certificates will move from Let's Encrypt to Google Trust Services. So, in future you may need to change the CA. I did not find this announcement on public internet yet. For me it is not 100% clear whether this change applies also when you run your MongoDB cluster on AWS.

Dear Wernfried,

This email is sent to you because you have an Atlas dedicated cluster deployed in Azure or Google Cloud. We are changing how MongoDB manages TLS certificates for Atlas clusters to ensure high-quality service with improved availability, sustainability and scalability. The following change will not incur any additional charges and will require little or no action for most customers.

MongoDB Atlas requires Transport Layer Security (TLS) encryption for customer data and intra-cluster network communications. MongoDB Atlas uses Let's Encrypt as the Certificate Authority (CA) for TLS certificates for all clusters. To improve availability, we are adding Google Trust Services as an additional CA for Atlas clusters.

By June 2025, ensure "GTS Root R1" and "GTS Root R2", under the "Root CAs" section in Google Trust Services, are included in your trust stores on application servers that connect to Atlas clusters to ensure seamless service continuity. MongoDB does not recommend hardcoding or pinning intermediate CAs in your application; please refer to the best practices recommended by MongoDB here and Google Trust Services here.

If Google Trust Services CAs are not included in your trust store, we recommend upgrading to a newer operating system or version of your programming language. If you cannot upgrade or are using a custom trust store, then you will need to manually add Google Trust Services to your trust store.

7
  • 1
    Hi, I just downloaded this file, isrgrootx1.pem, and it works. I have no idea why. Would you help me understand why this one works, while the pem file generated by mkcert does not ? What's so special about this file? Thank you so so much!
    – Yumin Gui
    Commented Jul 17, 2024 at 8:47
  • 1
    @YuminGui I guess you need to learn some basics about TLS/SSL certificates in general. A certificate is used to guarantee that the server (mongodb.net in this case) is really the server it claims to be. Certificate would be pointless if you could use your own generated certificate. Maybe compare the certificates with openssl. Commented Jul 17, 2024 at 9:50
  • Thank you for reply. But this isrgrootx1.pem file is also self-signed, according to the link letsencrypt.org/certificates. So, I'm still confused. Would you please elaborate it more? Thanks
    – Yumin Gui
    Commented Jul 18, 2024 at 7:20
  • @YuminGui Every root certificate is a self-signed certificate. A root certificate signs the server certificate (usually you have an intermediate certificate in between but actually there is no technical reason for it) and you need the root CA to verify the certificate which is provided by the server. Again, get familiar with the basics. Commented Jul 18, 2024 at 19:37
  • Thank you so much! I will watch some youtube videos. Forgive me if the questions are too dumb. Have a good day!
    – Yumin Gui
    Commented Jul 18, 2024 at 22:22
1

The same issue was happening with me. I thought it's the certificate issue, but I found out that my current IP address was not added to the mongoDB access IP Network list.

0

In addition to Wernfried Domscheit You need to provide the Server CA certificate in the connection string as well as download and place the file in the root directory of your project in case you follow the example url. Otherwise you have to specify the path to the file.

No need to install the certificate into the OS

1
  • 1
    You can do both. Usually when you put the CA to your OS then you don't have to specify it in the connection string. Commented Jul 18, 2024 at 19:35
0

Navigate :

Atlas "left Tab" Security > Network Access > change Ip TO Public or Your Network

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.