mongodb@376f577a0a75:/$ mongosh --version
2.8.1
mongodb@376f577a0a75:/$ mongosh "mongodb://mongodb-1.internal:27017,mongodb-2.internal:27017" --tls --tlsCAFile /etc/ssl/certs/mongoca.pem --tlsCertificateKeyFile /etc/ssl/certs/public_private.pem --authenticationMechanism MONGODB-X509 --authenticationDatabase='$external'
Enter TLS key file password: ************
Current Mongosh Log ID: 69ccf33da6992e32b2d805da
Connecting to:          mongodb://mongodb-1.internal:27017,mongodb-2.internal:27017/?tls=true&tlsCAFile=%2Fetc%2Fssl%2Fcerts%2Fmongoca.pem&tlsCertificateKeyFile=%2Fetc%2Fssl%2Fcerts%2Fpublic_private.pem&authMechanism=MONGODB-X509&authSource=%24external&appName=mongosh+2.8.1&tlsCertificateKeyFilePassword=<credentials>
MongoServerSelectionError: error:1C800064:Provider routines::bad decrypt// code placeholder

Create the tlsCertificateKeyFile 

# Create a Key with password as password1

openssl genrsa -aes256 -out private_key.pem 2048 
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

# Create a CSR and get the certificate from the Mongo CA

Create a combined tlsCertificateKeyFile 
# Try Login
mongosh "mongodb://mongodb-1.internal:27017,mongodb-2.internal:27017" --tls --tlsCAFile /etc/ssl/certs/mongoca.pem --tlsCertificateKeyFile /etc/ssl/certs/public_private.pem --authenticationMechanism MONGODB-X509 --authenticationDatabase='$external'
Enter TLS key file password: <password is password1> 

This works. 

# Create a Key with password as password@1
Repeat the same steps to create the cert and combined tlsCertificateKeyFile 

mongosh "mongodb://mongodb-1.internal:27017,mongodb-2.internal:27017" --tls --tlsCAFile /etc/ssl/certs/mongoca.pem --tlsCertificateKeyFile /etc/ssl/certs/public_private.pem --authenticationMechanism MONGODB-X509 --authenticationDatabase='$external'
Enter TLS key file password: <password is password@1> 

this will FAIL with 
MongoServerSelectionError: error:1C800064:Provider routines::bad decrypt

Also, 
if I pass --tlsCertificateKeyFilePassword password@1 it works

mongosh "mongodb://mongodb-1.internal:27017,mongodb-2.internal:27017" --tls --tlsCAFile /etc/ssl/certs/mongoca.pem --tlsCertificateKeyFile /etc/ssl/certs/public_private.pem --authenticationMechanism MONGODB-X509 --authenticationDatabase='$external' --tlsCertificateKeyFilePassword password@1