I am trying to use AWS DocumentDB.

This command works fine:

mongo --tls --host my.cluster-random.ap-south-1.docdb.amazonaws.com:27017 --tlsCAFile rds-combined-ca-bundle.pem --username mongo --password 'supersecure'

This command doesn't:

mongo 'mongodb://mongo@my.cluster-random.ap-south-1.docdb.amazonaws.com:27017/?tlsCAFile=rds-combined-ca-bundle.pem&tls=true'

I get the error:

SSL peer certificate validation failed: unable to get local issuer certificate

My impression is that the second case file doesn't get read. If I put the wrong file name in the first command - I get an OpenSSL error:

Failed global initialization: InvalidSSLConfiguration cannot read certificate authority file: 

In the second case it's like doesn't matter at all. Any combination of TLS options like "ignore" didn't give any effect either.

I am lost a bit. Any advice?