Launching mongod with command line parameter
--clusterAuthMode x509
does not enable authentication so that x509 can be used, if not the --auth flag is set explicitly. Since mongos does not support the --auth flag, clusterAuthMode x509 cannot be used on mongos until this issue is resolved.
Mongos workaround: use the operational equivalent --clusterAuthMode sendX509