title: AWS DocumentDB TLS connection with Java
body: <p>I am facing problems connecting with my DocumentDB cluster with plain Java over TLS/SSL</p>
  <p>The procedure I followed as per the <a href="https://docs.aws.amazon.com/documentdb/latest/developerguide/connect.html#w139aac29c11c13b5b9" rel="noreferrer">AWS docs</a> is this:</p>
  <p>I downloaded the <code>.pem</code> file from AWS and copied in the root of my java project, from where I executed:</p>
  <pre><code>keytool -importcert -trustcacerts -file rds-combined-ca-bundle.pem -alias certAlias -keystore rds-ca-certs -storepass keyStorePassword
  </code></pre>
  <p>This has created the <code>rds-ca-certs</code>at the root of my project which now looks like this:</p>
  <p><a href="https://i.stack.imgur.com/nitFj.png" rel="noreferrer"><img src="https://i.stack.imgur.com/nitFj.png" alt="enter image description here" /></a></p>
  <p>And, the java code in Main.java is:</p>
  <pre><code>package com.example.documentdb;
  
  import com.mongodb.MongoClient;
  import com.mongodb.MongoClientURI;
  import com.mongodb.ServerAddress;
  import com.mongodb.MongoException;
  import com.mongodb.client.MongoCursor;
  import com.mongodb.client.MongoDatabase;
  import com.mongodb.client.MongoCollection;
  import org.bson.Document;
  
  
  public final class Main {
      private Main() {
      }
      public static void main(String[] args) {
  
          String template = &quot;mongodb://%s:%s@%s/test?ssl=true&amp;replicaSet=rs0&amp;readpreference=%s&quot;;
          String username = &quot;myUsernameInCluster&quot;;
          String password = &quot;myPasswordInCluster&quot;;
          String clusterEndpoint = &quot;mycluster.node.us-east-1.docdb.amazonaws.com:27017&quot;;
          String readPreference = &quot;secondaryPreferred&quot;;
          String connectionString = String.format(template, username, password, clusterEndpoint, readPreference);
  
          String keystore = &quot;rds-ca-certs&quot;;
          String keystorePassword = &quot;keyStorePassword&quot;;
  
          System.setProperty(&quot;javax.net.ssl.trustStore&quot;, keystore);
          System.setProperty(&quot;javax.net.ssl.trustStorePassword&quot;, keystorePassword);
  
          MongoClientURI clientURI = new MongoClientURI(connectionString);
          MongoClient mongoClient = new MongoClient(clientURI);
  
          MongoDatabase testDB = mongoClient.getDatabase(&quot;test&quot;);
          MongoCollection&lt;Document&gt; numbersCollection = testDB.getCollection(&quot;numbers&quot;);
  
          Document doc = new Document(&quot;name&quot;, &quot;pi&quot;).append(&quot;value&quot;, 3.14159);
          numbersCollection.insertOne(doc);
  
          MongoCursor&lt;Document&gt; cursor = numbersCollection.find().iterator();
          try {
              while (cursor.hasNext()) {
                  System.out.println(cursor.next().toJson());
              }
          } finally {
              cursor.close();
          }
  
      }
  }
  </code></pre>
  <p>It gives me this ugly error:</p>
  <blockquote>
  <p>com.mongodb.MongoSocketWriteException: Exception sending message</p>
  <p>Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</p>
  </blockquote>
  <p>Interestingly, when I use the mongo CLI to connect over SSL/TLS, like this:</p>
  <pre><code>mongo --ssl --host mycluster.node.eu-central-1.docdb.amazonaws.com:27017 --sslCAFile rds-combined-ca-bundle.pem --username myUsernameInCluster --password myPasswordInCluster
  </code></pre>
  <p>It works perfectly, so I have discarded a networking issue and I think the problem is in the Java code itself or in the <code>keytool</code> command executed.</p>
  <p>Additionally, with TLS <em>disabled</em> in the cluster this <a href="https://docs.aws.amazon.com/documentdb/latest/developerguide/connect.html#w139aac29c11c17b5b9" rel="noreferrer">java code provided by AWS</a> (that only differs in the keystore configuration) works.</p>
  <p>PD: I know there are a bunch of other questions regarding SSL/TLS connection with AWS DocumentDB, but none of them address my issue specifically. Moreover, I have also checked plain mongodb TLS/SSL connection questions and the process differ so they are not valid for me.</p>