# SSLHandshakeFailed: SSL peer certificate validation failed: self-signed certificate in certificate chain

**URL:** <https://forums.percona.com/t/sslhandshakefailed-ssl-peer-certificate-validation-failed-self-signed-certificate-in-certificate-chain/38560>\
**Category:** Percona Backup for MongoDB\
**Tags:** percona, mongodb\
**Created:** [July 4, 2025, 8:59am UTC](https://forums.percona.com/t/sslhandshakefailed-ssl-peer-certificate-validation-failed-self-signed-certificate-in-certificate-chain/38560 "2025-07-04T08:59:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dylan\_moran](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@dylan\_moran](https://forums.percona.com/u/dylan_moran)\
**Post date:** [July 4, 2025, 8:59am UTC](https://forums.percona.com/t/sslhandshakefailed-ssl-peer-certificate-validation-failed-self-signed-certificate-in-certificate-chain/38560/1 "2025-07-04T08:59:15Z")

</div>

Hi there !

I’m working with an image of mongodb 7.0 in docker and i wanted to add a pbm-agent on my shared replicaset cluster.

To do that i put a role and user with large access in every node Primary mongod and Config Replicaset.

However, when i add a conteneer docker with pbm in primary node rs0, it says an error “SSLHandshakeFailed” to connect with my cluster.

I use tls for my cluster and i dont want to remove it.

What can i do ? It’s my first time with Percona and i dont know if i missed an important things.

I would like to connect my pbm with tls or accept that it is a self-signed certificate.

Docker command used :

```auto
docker run --name pbm-agent-rs0 --net host --mount type=bind,src=/ ***/*** / ***/**** /CA.crt,dst=/home/CA.crt,readonly=true -it --rm -e PBM_MONGODB_URI="mongodb://user:password@host:port,host:port/?authSource=admin&replSetName=rs0&tls=true&tlsCAFile=/home/CA.crt&allowInvalidCertificates=true&allowInvalidHostnames=true" percona/percona-backup-mongodb:2

```

Log error in pbm-agent-rs0 :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/4/c/4cc3d3140f2136ebc848200aa216d7371bdda818.png)

Log of destination server :

```auto
{"t":{"$date":"2025-07-04T08:35:39.361+00:00"},"s":"I", "c":"NETWORK", "id":22943, "ctx":"listener","msg":"Connection accepted",
"attr":{"remote":"**,"uuid":{"uuid":{"$uuid":"*"}},"connectionId":468504,"connectionCount":76}}

{"t":{"$date":"2025-07-04T08:35:39.363+00:00"},"s":"I", "c":"NETWORK", "id":6723804, "ctx":"conn468504","msg":"Ingress TLS handshake complete","attr":{"durationMillis":2}}

{"t":{"$date":"2025-07-04T08:35:39.363+00:00"},"s":"W", "c":"NETWORK", "id":23234, "ctx":"conn468504","msg":"No SSL certificate provided by peer"}

{"t":{"$date":"2025-07-04T08:35:39.363+00:00"},"s":"I", "c":"NETWORK", "id":22944, "ctx":"conn468504","msg":"Connection ended"

```

Thanks you

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [July 4, 2025, 11:16am UTC](https://forums.percona.com/t/sslhandshakefailed-ssl-peer-certificate-validation-failed-self-signed-certificate-in-certificate-chain/38560/2 "2025-07-04T11:16:40Z")

</div>

Hi, in the connection URI you are missing providing the client certificate that pbm will present to the server. Add the parameter: `&tlsCertificateKeyFile=/path/to/client.pem`  
As an alternative, you can configure your mongod server with `allowConnectionsWithoutCertificates: true`

---

<div class="post-metadata">

**Author:** ![dylan\_moran](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@dylan\_moran](https://forums.percona.com/u/dylan_moran)\
**Post date:** [July 4, 2025, 12:25pm UTC](https://forums.percona.com/t/sslhandshakefailed-ssl-peer-certificate-validation-failed-self-signed-certificate-in-certificate-chain/38560/3 "2025-07-04T12:25:51Z")

</div>

Thanks for the help !

i didn’t show that, but i have this option in my mongod.

![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/f/f/ff1f65d5b1b920bfdb651122c3420f722667a418.png)

but its doesn’t works…

and when i add the path of my “.pem”, it didn’t recognize and show the same error.

Do you have any idea ?

docker command used :

```auto

docker run --name pbm-agent-rs0 --net host --mount type=bind,src=/path/CA.crt,dst=/path/CA.crt --mount type=bind,src=/path/certificate.pem,dst=/path/certificate.pem -it --rm -e PBM_MONGODB_URI="mongodb://user:password@host:port,host:port/?authSource=admin&replicaSet=rs0&tls=true&allowInvalidCertificates=true&allowInvalidHostnames=true" percona/percona-backup-mongodb:2

```