{"record":{"id":"5edd9048f6b8673f","repo":"microsoft/aspire","slug":"mongodb-replica-set-member-memberwithouttls-name-does-not","errorCode":null,"errorMessage":"MongoDB replica set member '{memberWithoutTls.Name}' does not have TLS enabled, which is required for members of a replica set. Ensure an HTTPS/TLS certificate is available for the member, for example by trusting the ASP.NET Core developer certificate.","messagePattern":"MongoDB replica set member '(.+?)' does not have TLS enabled, which is required for members of a replica set\\. Ensure an HTTPS/TLS certificate is available for the member, for example by trusting the ASP\\.NET Core developer certificate\\.","errorType":"exception","errorClass":"DistributedApplicationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.MongoDB/ReplicaSet/MongoDBReplicaSetBuilderExtensions.cs","lineNumber":152,"sourceCode":"                    await evt.Eventing.PublishAsync(new BeforeResourceStartedEvent(resource, evt.Services), ct)\n                        .ConfigureAwait(false);\n\n                    connectionString = await rsResource.ConnectionStringExpression.GetValueAsync(ct).ConfigureAwait(false);\n\n                    await evt.Eventing.PublishAsync(new ConnectionStringAvailableEvent(resource, evt.Services), ct)\n                        .ConfigureAwait(false);\n\n                    await evt.Notifications.PublishUpdateAsync(resource, s => s with\n                    {\n                        State = KnownResourceStates.Starting,\n                    }).ConfigureAwait(false);\n\n                    if (membersList.Find(m => !m.TlsEnabled) is { } memberWithoutTls)\n                    {\n                        // NOTE: TLS is not optional for a replica set here: the `horizons` mechanism used below to advertise\n                        // host-reachable addresses to outside clients keys off the SNI of the incoming connection, which\n                        // only exists on TLS connections.\n                        throw new DistributedApplicationException($\"MongoDB replica set member '{memberWithoutTls.Name}' does not have TLS enabled, which is required for members of a replica set. Ensure an HTTPS/TLS certificate is available for the member, for example by trusting the ASP.NET Core developer certificate.\");\n                    }\n\n                    var memberConnections = await Task.WhenAll(membersList.Select(async member => new MemberConnection(\n                        member,\n                        await member.ConnectionStringExpression.GetValueAsync(ct).ConfigureAwait(false)\n                            ?? throw new DistributedApplicationException($\"The connection string of MongoDB replica set member '{member.Name}' could not be resolved.\")\n                    ))).ConfigureAwait(false);\n                    var initialPrimary = memberConnections[0];\n\n                    var memberHosts = await Task.WhenAll(membersList.Select(async m => new MemberHosts(\n                        // NOTE: `Internal` represents the host and port that should be accessible from within the MongoDB server's container.\n                        // NOTE: We know that the `TargetPort` always has a value (of 27017).\n                        Internal: $\"{m.Name}:{m.PrimaryEndpoint.TargetPort!.Value}\",\n                        // NOTE: `External` represents the host and port that would actually be advertised to outside clients, and should as such be accessible from outside the MongoDB server's container.\n                        External: await m.PrimaryEndpoint\n                            .Property(EndpointProperty.HostAndPort)\n                            .GetValueAsync(ct)\n                            .ConfigureAwait(false) ?? throw new DistributedApplicationException($\"The endpoint of MongoDB replica set member '{m.Name}' could not be resolved.\")","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.MongoDB/ReplicaSet/MongoDBReplicaSetBuilderExtensions.cs#L134-L170","documentation":"MongoDB replica set configuration requires every member container to run with TLS because the replica set advertises host-reachable addresses via the `horizons` mechanism, which keys off the SNI of incoming TLS connections. If any member's TlsEnabled flag is false when the replica set is being initialized, a DistributedApplicationException names that member.","triggerScenarios":"Calling AddMongoDBReplicaSet or WithMember where at least one member MongoDB resource was not configured with TLS (WithTlsMode not set or set to disabled), e.g. mixing a plain AddMongoDB container into a replica set.","commonSituations":"Forgetting to call WithTlsMode on one member in a multi-member replica set; creating members before enabling TLS; using a locally-trusted developer certificate that was not trusted (though that affects the certificate, the flag itself must be on).","solutions":["Enable TLS on every member: call .WithTlsMode(TlsModeEnabled...) on each MongoDB resource added to the replica set","Trust the ASP.NET Core developer certificate locally (`dotnet dev-certs https --trust`) so the auto-generated dev cert is available","Review each WithMember call to ensure the member resource derives from a TLS-enabled MongoDB container"],"exampleFix":"// before\nvar mongo1 = builder.AddMongoDB(\"mongo1\");\nbuilder.AddMongoDBReplicaSet(\"rs\", mongo1);\n// after\nvar mongo1 = builder.AddMongoDB(\"mongo1\").WithTlsMode(TlsMode.Enabled); // or the API equivalent\nbuilder.AddMongoDBReplicaSet(\"rs\", mongo1);","handlingStrategy":"validation","validationCode":"bool allTls = members.All(m => m.Resource.TlsEnabled);\nif (!allTls) throw new InvalidOperationException(\"All replica set members must have TLS enabled\");","typeGuard":null,"tryCatchPattern":"try { builder.AddMongoDBReplicaSet(name, member); }\ncatch (DistributedApplicationException ex) when (ex.Message.Contains(\"does not have TLS enabled\")) { /* add WithTlsMode to the named member */ }","preventionTips":["Enable TLS on every MongoDB resource intended as a replica set member","Trust the ASP.NET Core developer certificate locally before running","Standardize member creation through one helper that always applies WithTlsMode"],"tags":["mongodb","replica-set","tls","security"],"backgroundTag":"feature-not-enabled","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}