https://jira.mongodb.org/browse/SERVER-105783 reports:
Clients may successfully perform a TLS handshake with a
MongoDB server despite presenting a client certificate not
aligning with the documented Extended Key Usage (EKU)
requirements. A certificate that specifies extendedKeyUsage
but is missing extendedKeyUsage = clientAuth may still be
successfully authenticated via the TLS handshake as a
client. This issue is specific to MongoDB servers running
on Windows or Apple as the expected validation behavior
functions correctly on Linux systems. Additionally, MongoDB
servers may successfully establish egress TLS connections
with servers that present server certificates not aligning
with the documented Extended Key Usage (EKU) requirements.
A certificate that specifies extendedKeyUsage but is missing
extendedKeyUsage = serverAuth may still be successfully
authenticated via the TLS handshake as a server. This issue
is specific to MongoDB servers running on Apple as the
expected validation behavior functions correctly on both
Linux and Windows systems.