Unable to connect MongoDB Compass to AWS DocumentDB using SSH tunnel

I am new to mongoDB trying to setup tools for my new project. Most of my infrastructure run on AWS so i prefer to use AWS documentDB. I manage to connect to documentDB from EC2 both via mongo client or NodeJS aplication. but it would be good to mange documentDB from my Windows workstation using MongoDB Compass.

As we know, we can not direct connect any mongo client from outside AWS to DocumentDB Connecting to an Amazon DocumentDB Cluster from Outside an Amazon VPC
so we need SSH tunnel through EC2. I try many options but still fail... below are most likely 2 options:

Option 1: Connect using MongoDB Compass SSH tunnel

Error: unable to get local issuer certificate

both RDS-COMBINED-CA-BUNDLE.PEM and SSH Key already supplied so which one unable to get?

as red highlight on SSH port, I also tried to open another SSHD port on server and tried to connect using second port but still failed.

Option 2: Connect using Putty SSH tunnel

Error: Hostname/IP does not match certificate's altnames...

since MongoDB Compass need to connect to locathost to get into tunnel and i still can not find the way to supply --sslAllowInvalidHostnames options.

So, what i can do to get around this ?

MongoDB Compass: 1.25.0

I am done with Compass. successful established "robo3t" connection to AWS DocumentDB using this guild.

https://docs.aws.amazon.com/documentdb/latest/developerguide/robo3t.html

If you edit the connection string directly in MongoDB Compass you can set options that may not be accessible in the user interface.

Below is an example with tweaked parameters to connect without using TLS:

mongodb://xxxx:yyyy@localhost:27017/?authSource=admin&connectTimeoutMS=10000&readPreference=primary&authMechanism=SCRAM-SHA-1&serverSelectionTimeoutMS=5000&appname=MongoDB%20Compass&ssl=false

As of Jan 2022 MongoDB Compass does not support sslInvalidHostNameAllowed=true in the connection builder form, this is the parameter you are missing in order to connect to AWS DocumentDB while ssh tunneling to a machine inside the same VPC of the database itself.

I used Studio 3T and it worked perfectly. You could create the connection string yourself or try other GUI.