I know this has been answered but I think this response is appropriate. Putting this here for anyone finding this in the future. This issue was addressed in this Splunk help article: https://splunk.my.site.com/customer/s/article/Certificate-issue-when-Upgrading-to-Splu.   To summarize, the MongoDB service needs the certificate to have both TLS Web Server Authentication, TLS Web Client Authentication under the X509v3 Extended Key Usage. If you run the following command, you should see the following output.  $SPLUNK_HOME/bin/splunk cmd openssl x509 -in mycertificate.pem -text -noout   output should be: ... X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication   ... View more