There seems to be a possible documentation bug: https://docs.mongodb.com/v3.2/core/security-x.509/#member-certificate-requirements.

If the certificate includes the Extended Key Usage (extendedKeyUsage) setting, the value must include clientAuth (“TLS Web Client Authentication”).

extendedKeyUsage = clientAuth

While this is not strictly incorrect, it is misleading as "TLS Web Server Authentication" is also required. Please note that communication between the members works both ways.