TLS handshake fails

Identify whether the failure occurs between the client and Nexo or between Nexo and MongoDB.

Check

1. Verify the certificate is current and valid for the hostname used.
2. Confirm the issuing CA is trusted by the connecting side.
3. Check certificate chain completeness.
4. Verify client-certificate requirements and key pairing.
5. Confirm both sides permit a common TLS version and cipher configuration.
6. Check system time on participating hosts.

Avoid bypassing certificate verification. If a temporary diagnostic exception is unavoidable in a test environment, remove it immediately and document the root cause.