TLS handshake (alert number 80) issue between AWS ECS instance and Atlas

[Mathilde_Ffrench]

Hello there,

I’m facing a TLS handshare issue on my AWS docker container node I’m not able to reproduce locally :

MongoServerSelectionError: 00789A21077F0000:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1605:SSL alert number 80

at Timeout._onTimeout (/opt/mira/node_modules/mongodb/lib/sdam/topology.js:278:38)
at listOnTimeout (node:internal/timers:568:17)
at process.processTimers (node:internal/timers:511:7) {
reason: TopologyDescription {
type: 'ReplicaSetNoPrimary',
servers: Map(3) {
'ac-jl4g2pn-shard-00-02.mw2ni5a.mongodb.net:27017' => [ServerDescription],
'ac-jl4g2pn-shard-00-00.mw2ni5a.mongodb.net:27017' => [ServerDescription],
'ac-jl4g2pn-shard-00-01.mw2ni5a.mongodb.net:27017' => [ServerDescription]
},
stale: false,
compatible: true,
heartbeatFrequencyMS: 10000,
localThresholdMS: 15,
setName: 'atlas-zogtj8-shard-0',
maxElectionId: null,
maxSetVersion: null,
commonWireVersion: 0,
logicalSessionTimeoutMinutes: null
},
code: undefined,
[Symbol(errorLabels)]: Set(0) {}
}
---------------------------------

From stack overflow, I got following explanation about TLS “alert number 80” : it means “internal_error” (see RFC 5246 Section 7.2). It is sent by the TLS server to the TLS client meaning

An internal error unrelated to the peer or the correctness of the protocol (such as a memory allocation failure) makes it impossible to continue. This message is always fatal.

Does anyone got that issue already and found a solution on it ?

Thank you for your help !

[Mathilde_Ffrench]

I found the solution on my problem.

Indeed, on my current AWS setup (quick & dirty public public subnet + public IP address), each time I update the ECS service task, the ENI is changing and so with it the public IP address.

I did changed my Atlas firewall setup accordingly just before the task init and seems now my services are happily connecting to my Atlas DB.