microsoft/aspire · error · DistributedApplicationException

MongoDB replica set member

Error message

MongoDB replica set member '{memberWithoutTls.Name}' does not have TLS enabled, which is required for members of a replica set. Ensure an HTTPS/TLS certificate is available for the member, for example by trusting the ASP.NET Core developer certificate.

What it means

MongoDB replica set configuration requires every member container to run with TLS because the replica set advertises host-reachable addresses via the `horizons` mechanism, which keys off the SNI of incoming TLS connections. If any member's TlsEnabled flag is false when the replica set is being initialized, a DistributedApplicationException names that member.

Solutions

1. Enable TLS on every member: call .WithTlsMode(TlsModeEnabled...) on each MongoDB resource added to the replica set
2. Trust the ASP.NET Core developer certificate locally (`dotnet dev-certs https --trust`) so the auto-generated dev cert is available
3. Review each WithMember call to ensure the member resource derives from a TLS-enabled MongoDB container

Example fix

// before
var mongo1 = builder.AddMongoDB("mongo1");
builder.AddMongoDBReplicaSet("rs", mongo1);
// after
var mongo1 = builder.AddMongoDB("mongo1").WithTlsMode(TlsMode.Enabled); // or the API equivalent
builder.AddMongoDBReplicaSet("rs", mongo1);

bool allTls = members.All(m => m.Resource.TlsEnabled);
if (!allTls) throw new InvalidOperationException("All replica set members must have TLS enabled");

try { builder.AddMongoDBReplicaSet(name, member); }
catch (DistributedApplicationException ex) when (ex.Message.Contains("does not have TLS enabled")) { /* add WithTlsMode to the named member */ }

When it happens

Trigger: Calling AddMongoDBReplicaSet or WithMember where at least one member MongoDB resource was not configured with TLS (WithTlsMode not set or set to disabled), e.g. mixing a plain AddMongoDB container into a replica set.

Common situations: Forgetting to call WithTlsMode on one member in a multi-member replica set; creating members before enabling TLS; using a locally-trusted developer certificate that was not trusted (though that affects the certificate, the flag itself must be on).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Cannot build connection string for MongoDB replica set…
• Cannot remove '"))} from the existing MongoDB replica set '…
• Connection string is unavailable
• Failed to configure MongoDB replica set resource
• The connection string of MongoDB replica set member

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/5edd9048f6b8673f. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.MongoDB/ReplicaSet/MongoDBReplicaSetBuilderExtensions.cs:152

                    await evt.Eventing.PublishAsync(new BeforeResourceStartedEvent(resource, evt.Services), ct)
                        .ConfigureAwait(false);

                    connectionString = await rsResource.ConnectionStringExpression.GetValueAsync(ct).ConfigureAwait(false);

                    await evt.Eventing.PublishAsync(new ConnectionStringAvailableEvent(resource, evt.Services), ct)
                        .ConfigureAwait(false);

                    await evt.Notifications.PublishUpdateAsync(resource, s => s with
                    {
                        State = KnownResourceStates.Starting,
                    }).ConfigureAwait(false);

                    if (membersList.Find(m => !m.TlsEnabled) is { } memberWithoutTls)
                    {
                        // NOTE: TLS is not optional for a replica set here: the `horizons` mechanism used below to advertise
                        // host-reachable addresses to outside clients keys off the SNI of the incoming connection, which
                        // only exists on TLS connections.
                        throw new DistributedApplicationException($"MongoDB replica set member '{memberWithoutTls.Name}' does not have TLS enabled, which is required for members of a replica set. Ensure an HTTPS/TLS certificate is available for the member, for example by trusting the ASP.NET Core developer certificate.");
                    }

                    var memberConnections = await Task.WhenAll(membersList.Select(async member => new MemberConnection(
                        member,
                        await member.ConnectionStringExpression.GetValueAsync(ct).ConfigureAwait(false)
                            ?? throw new DistributedApplicationException($"The connection string of MongoDB replica set member '{member.Name}' could not be resolved.")
                    ))).ConfigureAwait(false);
                    var initialPrimary = memberConnections[0];

                    var memberHosts = await Task.WhenAll(membersList.Select(async m => new MemberHosts(
                        // NOTE: `Internal` represents the host and port that should be accessible from within the MongoDB server's container.
                        // NOTE: We know that the `TargetPort` always has a value (of 27017).
                        Internal: $"{m.Name}:{m.PrimaryEndpoint.TargetPort!.Value}",
                        // NOTE: `External` represents the host and port that would actually be advertised to outside clients, and should as such be accessible from outside the MongoDB server's container.
                        External: await m.PrimaryEndpoint
                            .Property(EndpointProperty.HostAndPort)
                            .GetValueAsync(ct)
                            .ConfigureAwait(false) ?? throw new DistributedApplicationException($"The endpoint of MongoDB replica set member '{m.Name}' could not be resolved.")

View on GitHub (pinned to 25830f84bd)