Update upstream source from tag 'upstream/6.0.0'master

Update to upstream version '6.0.0'
with Debian dir 5604a80ec1c96ca76f25f40d78e6ef855abec322

30 files changed, 390 insertions, 520 deletions

diff --git a/jstests/ssl/config-canonicalize-normal-ports.js b/jstests/ssl/config-canonicalize-normal-ports.js
index ddb815ade23..e1e8f176a92 100644
--- a/jstests/ssl/config-canonicalize-normal-ports.js
+++ b/jstests/ssl/config-canonicalize-normal-ports.js
@@ -6,7 +6,6 @@
 const mongod = MongoRunner.runMongod({
     tlsOnNormalPorts: '',
     tlsCertificateKeyFile: 'jstests/libs/server.pem',
-    tlsCAFile: 'jstests/libs/ca.pem'
 });
 assert(mongod);
 assert.commandWorked(mongod.getDB('admin').runCommand({hello: 1}));
diff --git a/jstests/ssl/libs/localhost-cn-with-san.pem b/jstests/ssl/libs/localhost-cn-with-san.pem
index 2222609932a..d91b1ae5069 100644
--- a/jstests/ssl/libs/localhost-cn-with-san.pem
+++ b/jstests/ssl/libs/localhost-cn-with-san.pem
@@ -3,52 +3,52 @@
 #
 # Localhost based certificate using non-matching subject alternate name.
 -----BEGIN CERTIFICATE-----
-MIIDkDCCAnigAwIBAgIERiogkTANBgkqhkiG9w0BAQsFADB0MQswCQYDVQQGEwJV
+MIIDkDCCAnigAwIBAgIEV9X0HjANBgkqhkiG9w0BAQsFADB0MQswCQYDVQQGEwJV
 UzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5ldyBZb3JrIENpdHkxEDAO
 BgNVBAoMB01vbmdvREIxDzANBgNVBAsMBktlcm5lbDEXMBUGA1UEAwwOS2VybmVs
-IFRlc3QgQ0EwHhcNMjQwNjA1MTYxNDQ3WhcNMjYwOTA3MTYxNDQ3WjBvMQswCQYD
+IFRlc3QgQ0EwHhcNMjIwMTI3MjE1OTQ0WhcNMjQwNDMwMjE1OTQ0WjBvMQswCQYD
 VQQGEwJVUzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5ldyBZb3JrIENp
 dHkxEDAOBgNVBAoMB01vbmdvREIxDzANBgNVBAsMBktlcm5lbDESMBAGA1UEAwwJ
-bG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzaABiDJK
-rLBFw/VeBu0yFo6o6ZgYAxqSnV7hi8a7SIfcol3WwdUTAzUGoJhQYYNQgRCvSzSk
-3u5Nbz736u6RpQYCrQbXG0qSgnQVGOvqAL5GE+jXNf6r4TkuPMkYRgWsQq118H1M
-N/tJ5ZSS4dq4f15xBogaH+Eb4/O5v/Bedh/1pS7c6E6y9UEAVvYCySGXjXM11TjP
-DjxDgq6TDbkc4F/YAh7e0+CoRgB0yb3zi6j3TPmBBxWaVsWJ75rZekwHztBaBn79
-DqrqqU0U0jqrKJMHiguj1Qtzoxl0C724vD8GhgBq5nNAlAv7shLvZH0KA7QvY2kz
-5maXLbxFnmvUuQIDAQABoy8wLTATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREE
-DzANggtleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAgP67hT3lnCHBcugv
-Gt4wE8xSUt9rk6xyyf1VGF7v0ErqSykG5rEnjMG0vc+/77u/+JCace0CDv/7eqlR
-BJWilgC3JIi/kXOTFxFxk5AD6NGUYx32UDlZgUe20LXBwm7rSzGfAOT9trphLlKD
-4gW88bY9n9iLI87LutKR6wZ/opm/1YW9w2kGAUMBXHPTltWMXcNsElsV/+E8farS
-KlDCciELkRHIL/DrlKd+l17T82wa4d2WvyQaIUgvnicwOE8iVEeaZuXwxoMb/0q7
-jKGFmBgB9hNTkR9aGYsvI8+s0GmqOL7fK/mAc9YDvn6fw5qNyhx4DW0g0FecqFGI
-6ixfUg==
+bG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5uaoVP0l
+xsKbPIr8qNsd7OQ2Vks2WzaPiwiyQ7uRd8+kRymJE/F+nKAgZvUFebjT70FJs/kI
+D1dQqcAn3OxOZFSCv62i0Owp7oLrQ3fiQR2xwuQVFa2D8hV9z8vLc7CZyiKdi4EU
+EZOv8N1K8KxThV7E12YI5OVXQl+oniXwbDf4Dkiex7go4mgIqv9SBDjBLvWheCkP
+WTSGULtsL8Dg42neqR7Uh/4Iawm7ka0czwluM0GrLjDAirdw6OOBYNuc3Be1XhjK
+/5zY6JOt6yeHce2jjte7YzLoCBv0hm1sVyIkocrxPi6kvC8crw+RGI0m9ijZIq0K
+N90aMGwVq32jkwIDAQABoy8wLTATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREE
+DzANggtleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAKroMjfypcbZ5Nq6x
+chBMOgVZRMtleqosP51zBk8KTkLSyfQCYbwM+lq+Us4Y5zzLHjHUmQltJi5Yn4l6
+Voe33UEAi5xA0SEPGBvG2uzGzeY6ShQl+BhfUxgMWxaitm8/Hr0wnpm8AqOglskb
+9GozqQHfWISwY+9JDxR7aLaFofgRhR2iZEqbELkz+1KwOoUtHm8HMvS+k6tZziTE
+fO6Ergg8iCVixvtV0EOKUMqmiUSXH0ZT6uOw/z1XFloJSolg95g07z5LgCRMe+zT
+zwNOmnHdJwJTDYjXMQS1sEdvjQvBKObJ4xIKhkwqrTOx+PY40yBNYN2iPIViWEOv
+sHxp0A==
 -----END CERTIFICATE-----
 -----BEGIN PRIVATE KEY-----
-MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDNoAGIMkqssEXD
-9V4G7TIWjqjpmBgDGpKdXuGLxrtIh9yiXdbB1RMDNQagmFBhg1CBEK9LNKTe7k1v
-Pvfq7pGlBgKtBtcbSpKCdBUY6+oAvkYT6Nc1/qvhOS48yRhGBaxCrXXwfUw3+0nl
-lJLh2rh/XnEGiBof4Rvj87m/8F52H/WlLtzoTrL1QQBW9gLJIZeNczXVOM8OPEOC
-rpMNuRzgX9gCHt7T4KhGAHTJvfOLqPdM+YEHFZpWxYnvmtl6TAfO0FoGfv0Oquqp
-TRTSOqsokweKC6PVC3OjGXQLvbi8PwaGAGrmc0CUC/uyEu9kfQoDtC9jaTPmZpct
-vEWea9S5AgMBAAECggEBAJde4+HUS/6mYSVpmsd0k7vhV11nFr4qMKZi85zHNpWl
-Vnm8pNzaM33X6kIM/pdaaMgqdTDi10A5o41yiGVNLLCUJSIk9/NiSUp5lBJdkUzs
-xX/gl5VrHjLVukELNLBPesk3EqxwQMyxU2wLnLlhHxK8fm31gW3YdISxphszIwbH
-G60Sa2oUrzWprtrOvhgFO/MUe54k7ltvWKBFh+Z1nflK7JgtRSWar1fZ28Ko4Nf5
-pC3VY7/zGzHs+A2qtvZLnM0wZjKEpP31yUMUi06HYcNL6lW2vfJJMwPS5CkbX2Ps
-6oKdxl4oC6kEDPLbaFTtYSsaAznkJOa1m03e7wF6sDUCgYEA9Te0rsfe7XVkq+vJ
-OrTkSliZh91lhhMWVyY5PWUVSkGx/+tw+h5tvTJhv5O3mPoHlcvS25Dn63p/2RSV
-JKsVbX4Hgdlv30OGftua72goO5XR7Tw7IisISoQn7A0m3w8Fb1W1FPdO9M+v2F0E
-Dio9Mg3tyUBbOYsA38sfKmSVoNsCgYEA1qqgP/whdzLXTU+ccQVLmiKBGpw1xDNp
-cI7K5vsmPMhOoR2FDgYe5j6/ggIe+jgBWVB+tKw/+RFzWeoivno0QcVvojutuQeq
-oYI99rlppzHwLStt+KQD+IwevDlSQPduZWRY2czUUja7exvVaYA4GJD/bGosG6If
-I0piVGYIuvsCgYEA1BH3GukULLzH8b8a6sCiZoG1VcDtGkTLn1cZTbVr8iparH+L
-12QVd/hofOxdbdleUfhSRT1OtWHdy3l3epzTDTxfdbb8f1PAr1lw5vdnRBDP2qGq
-amRY6Ujd1dGR+nrdMmonDxjKmgI7i5z18uIoxm8xZElaG6vRd7oNG/adSN0CgYEA
-kRdyiMzZsb9jVpXgn2N83glEScAbdylosvNQoR5PkfWxb6SMMhZg/C6dMjpMxcLk
-5oFJosRp2Oa6mKNwKF5gw7O26Gh92vobkl59ky1vA9r1AxK/mbcCGBRdEcuMlOyo
-aU+R3mRbfdYQkf0WGeDYCYK3oYeBmIvTj/7Ox0zPydECgYEA1EFC3o0H9e5ZKQKe
-wRFwKXmHdYDh1GgK9F7QSK14PNjno57n5Ibecb45kGsAIdkaCEnmtQbZLoFKPd/C
-3NVn6ufQVfi34EJnUNM8mTOhFSch6yIeFPkkpPZNXqOsHznOwze84AIwYobgWdP3
-dL3GfY+v2lKB9FgFpud41focFFY=
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDm5qhU/SXGwps8
+ivyo2x3s5DZWSzZbNo+LCLJDu5F3z6RHKYkT8X6coCBm9QV5uNPvQUmz+QgPV1Cp
+wCfc7E5kVIK/raLQ7CnugutDd+JBHbHC5BUVrYPyFX3Py8tzsJnKIp2LgRQRk6/w
+3UrwrFOFXsTXZgjk5VdCX6ieJfBsN/gOSJ7HuCjiaAiq/1IEOMEu9aF4KQ9ZNIZQ
+u2wvwODjad6pHtSH/ghrCbuRrRzPCW4zQasuMMCKt3Do44Fg25zcF7VeGMr/nNjo
+k63rJ4dx7aOO17tjMugIG/SGbWxXIiShyvE+LqS8LxyvD5EYjSb2KNkirQo33Row
+bBWrfaOTAgMBAAECggEBAMqFgRuaNeoRgqsllNpd5e+Dcw1ZRsHWJyzhYcn62Gpn
+20T3b13osQ6bfBAR1M2giXMOpqCOSr157iwVeGFTeqaRYWTR3T62BUlH1yYEHpTS
+gLnZ54xt9o78vq7lpvs/6IPcvKZBfuKz0NvInRRfcZpHNwteWWq6pUB4OqMLz8Z5
+3j9mo+69izUOaTbLptXngV9c0TYi2J7JHVwV7nxZga4sbq5btxN7gTv/M6dKKEvl
+CB7p/aD+EVMUgIICw++FvykgOfCXVbUEWld97k68R+UY805xec15ovAIIwzPWViG
+ry8yVUewVM6a03AOHEV9lOtfyJOm683EnflvFVG3nDECgYEA8zDwjk+gDfbEC0+1
+C1zsC9ojyg3tve80chrnpwQfL8hrrdUWq0eHpL1boA1vYvgl5Uukqkj6xKFaJXFZ
+0QaDB6xTemxpeXX/+KffjgZbglvpm4Yr5C/tCv6U0lUx19ReQB9L+Qqpzg5kJvDc
+xc7eSFW3RPo7bZJJLUwLq3Np1GcCgYEA8xAA+3N2+/TjTOae4Ks1VtcvBn5shs4Z
+kg3IraLznpkL1SlQ4asxr3iy0ie7gWUIKS4TwELDjXnNprfgmJZfZMgE2MZfZwCO
+9P0/p+BCtqubekVFnMGezul3XzzT+wPCGoOlqz5VeiW6ognm9RBm5e0jz42j13dp
+B5z/wFatm/UCgYBVF1OkR8IWALjZyFrtjebdwsbxBOyhn5f3MOjLLIsI+hSLL1sO
+NSoF/2eW2fyWYYNI9q24E28C6/4RydaGZ8PjJG3VESfaouochAiZtinAtA5KJ6kl
+34sOZMOH0N1uylTsFMdNbWi6u5hZc7+byuVF5BALJ48xqJTIL6qJpAlskwKBgE3j
+Xf011fYNVl1JNbZXBsOqNvaEwrA8ETOdWSZTJnA3KPSIxdNa8ZQCQINZmhtvzbqs
+ekXM3y9RzdXT7JPY8/6uneb9QosWQbk+Ag0Ar0AsI6l90z3VSdeSNt989YzlemjW
+sNr8IZX/yxurwqfbNq4NXMFg6RTdvfljlQ0EeaOVAoGAR002FIKL1Z/3DqbVV+tQ
+FlOksFDTshG1Y9mDQAfTCSlNBeGDz/bQnSo1WWj/DXVLoHxpBglvFmWSajmOUa1R
+W4JDOK/W949pPYfP1QRvbJVGmZ/Y8u90GZbBjWQF+E9yLicESOpN/BH45FIbxQHQ
+2wH/9G1OCozBqCVXGhJw7CA=
 -----END PRIVATE KEY-----
diff --git a/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha1 b/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha1
index 0fcfde10453..1127761edbf 100644
--- a/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha1
+++ b/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha1
@@ -1 +1 @@
-32B94BA3DAC534E62EB5A78B4468A8DD4DF42BF1
\ No newline at end of file
+A8FBDA18A45E8945D1D6E08E77B3070314B80458
\ No newline at end of file
diff --git a/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha256 b/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha256
index 29dbf817bc1..4bb65aa4d90 100644
--- a/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha256
+++ b/jstests/ssl/libs/localhost-cn-with-san.pem.digest.sha256
@@ -1 +1 @@
-5ABBAAA207CD0A88EBD71EE97D10DA66428B8A930B6149E5CE708D4024FE4AD6
\ No newline at end of file
+5926109C2D0A4565771FFA92814319B5946DF5710A4F99A77FFF9A7881681376
\ No newline at end of file
diff --git a/jstests/ssl/libs/ssl_helpers.js b/jstests/ssl/libs/ssl_helpers.js
index c03e38a1778..3401e86dd9e 100644
--- a/jstests/ssl/libs/ssl_helpers.js
+++ b/jstests/ssl/libs/ssl_helpers.js
@@ -1,5 +1,4 @@
 load('jstests/multiVersion/libs/multi_rs.js');
-load('jstests/libs/os_helpers.js');
 
 // Do not fail if this test leaves unterminated processes because this file expects replset1.js to
 // throw for invalid SSL options.
@@ -288,7 +287,6 @@ function detectDefaultTLSProtocol() {
         useLogFiles: true,
         tlsLogVersions: "TLS1_0,TLS1_1,TLS1_2,TLS1_3",
         waitForConnect: true,
-        tlsCAFile: CA_CERT
     });
 
     assert.eq(0,
@@ -297,9 +295,9 @@ function detectDefaultTLSProtocol() {
                               '--port',
                               conn.port,
                               '--sslPEMKeyFile',
-                              CLIENT_CERT,
+                              'jstests/libs/client.pem',
                               '--sslCAFile',
-                              CA_CERT,
+                              'jstests/libs/ca.pem',
                               '--eval',
                               ';'));
 
@@ -410,12 +408,7 @@ function sslProviderSupportsTLS1_0() {
         const cryptoPolicy = cat("/etc/crypto-policies/config");
         return cryptoPolicy.includes("LEGACY");
     }
-
-    if (isOpenSSL3orGreater()) {
-        return false;
-    }
-
-    return !isDebian() && !isUbuntu2004();
+    return !isDebian10() && !isUbuntu2004();
 }
 
 function sslProviderSupportsTLS1_1() {
@@ -423,22 +416,7 @@ function sslProviderSupportsTLS1_1() {
         const cryptoPolicy = cat("/etc/crypto-policies/config");
         return cryptoPolicy.includes("LEGACY");
     }
-
-    if (isOpenSSL3orGreater()) {
-        return false;
-    }
-
-    return !isDebian() && !isUbuntu2004();
-}
-
-function isOpenSSL3orGreater() {
-    // Windows and macOS do not have "openssl.compiled" in buildInfo but they do have "running"
-    const opensslCompiledIn = getBuildInfo().openssl.compiled !== undefined;
-    if (!opensslCompiledIn) {
-        return false;
-    }
-
-    return opensslVersionAsInt() >= 0x3000000;
+    return !isDebian10() && !isUbuntu2004();
 }
 
 function opensslVersionAsInt() {
@@ -455,22 +433,6 @@ function opensslVersionAsInt() {
     return version;
 }
 
-function supportsFIPS() {
-    // OpenSSL supports FIPS
-    let expectSupportsFIPS = (determineSSLProvider() == "openssl");
-
-    // But OpenSSL supports FIPS only sometimes
-    // - Debian does not support FIPS, Fedora 37 does not, Fedora 38 does
-    // - Ubuntu only supports FIPS with Ubuntu pro
-    if (expectSupportsFIPS) {
-        if (isDebian() || isUbuntu()) {
-            expectSupportsFIPS = false;
-        }
-    }
-
-    return expectSupportsFIPS;
-}
-
 function copyCertificateFile(a, b) {
     if (_isWindows()) {
         // correctly replace forward slashes for Windows
diff --git a/jstests/ssl/mongo_uri_secondaries.js b/jstests/ssl/mongo_uri_secondaries.js
new file mode 100644
index 00000000000..73cca540c80
--- /dev/null
+++ b/jstests/ssl/mongo_uri_secondaries.js
@@ -0,0 +1,75 @@
+// On OSX this test assumes that jstests/libs/trusted-ca.pem has been added as a trusted
+// certificate to the login keychain of the evergreen user. See,
+// https://github.com/10gen/buildslave-cookbooks/commit/af7cabe5b6e0885902ebd4902f7f974b64cc8961
+// for details.
+// To install trusted-ca.pem for local testing on OSX, invoke the following at a console:
+//   security add-trusted-cert -d jstests/libs/trusted-ca.pem
+(function() {
+'use strict';
+
+const HOST_TYPE = getBuildInfo().buildEnvironment.target_os;
+if (HOST_TYPE == "windows") {
+    // OpenSSL backed imports Root CA and intermediate CA
+    runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
+
+    // SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
+    // Current User.
+    runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
+}
+
+const x509Options = {
+    sslMode: 'requireSSL',
+    sslPEMKeyFile: 'jstests/libs/trusted-server.pem',
+    sslCAFile: 'jstests/libs/trusted-ca.pem',
+    sslAllowInvalidCertificates: '',
+    sslWeakCertificateValidation: '',
+};
+
+const rst = new ReplSetTest(
+    {nodes: 2, name: "sslSet", useHostName: false, nodeOptions: x509Options, waitForKeys: false});
+rst.startSet();
+rst.initiate();
+
+const subShellCommand = function(hosts) {
+    var Ms = [];
+    for (var i = 0; i < 10; i++) {
+        Ms.push(
+            new Mongo("mongodb://" + hosts[0] + "," + hosts[1] + "/?ssl=true&replicaSet=sslSet"));
+    }
+
+    for (var i = 0; i < 10; i++) {
+        var db = Ms[i].getDB("test");
+        db.setSecondaryOk();
+        db.col.find().readPref("secondary").toArray();
+    }
+};
+
+const subShellCommandFormatter = function(replSet) {
+    var hosts = [];
+    replSet.nodes.forEach((node) => {
+        hosts.push("localhost:" + node.port);
+    });
+
+    let command = `
+            (function () {
+                'use strict';
+                let command = ${subShellCommand.toString()};
+                let hosts = ${tojson(hosts)};
+                command(hosts);
+            }());`;
+
+    return command;
+};
+
+function runWithEnv(args, env) {
+    const pid = _startMongoProgram({args: args, env: env});
+    return waitProgram(pid);
+}
+
+const subShellArgs = ['mongo', '--nodb', '--eval', subShellCommandFormatter(rst)];
+
+const retVal = runWithEnv(subShellArgs, {"SSL_CERT_FILE": "jstests/libs/trusted-ca.pem"});
+assert.eq(retVal, 0, 'mongo shell did not succeed with exit code 0');
+
+rst.stopSet();
+}());
diff --git a/jstests/ssl/peer_validation_without_cafile.js b/jstests/ssl/peer_validation_without_cafile.js
deleted file mode 100644
index 9f1ed043525..00000000000
--- a/jstests/ssl/peer_validation_without_cafile.js
+++ /dev/null
@@ -1,86 +0,0 @@
-(function() {
-"use strict";
-
-if (getBuildInfo().buildEnvironment.target_os != "linux") {
-    // these tests are specifically for linux
-    return;
-}
-
-function testRS(opts, succeed) {
-    const origSkipCheck = TestData.skipCheckDBHashes;
-    const rsOpts = {
-        // Use localhost so that SAN matches.
-        useHostName: false,
-        nodes: {node0: opts, node1: opts},
-    };
-    const rs = new ReplSetTest(rsOpts);
-    rs.startSet({
-        env: {
-            SSL_CERT_FILE: 'jstests/libs/ca.pem',
-        },
-    });
-    if (succeed) {
-        rs.initiate();
-        assert.commandWorked(rs.getPrimary().getDB('admin').runCommand({hello: 1}));
-    } else {
-        // By default, rs.initiate takes a very long time to timeout. We should shorten this
-        // period, because we expect it to fail. ReplSetTest has both a static and local copy
-        // of kDefaultTimeOutMS, so we must override both.
-        const oldTimeout = ReplSetTest.kDefaultTimeoutMS;
-        const shortTimeout = 2 * 60 * 1000;
-        ReplSetTest.kDefaultTimeoutMS = shortTimeout;
-        rs.kDefaultTimeoutMS = shortTimeout;
-        // The rs.initiate will fail in an assert.soon, which would ordinarily trigger the hang
-        // analyzer.  We don't want that to happen, so we disable it here.
-        MongoRunner.runHangAnalyzer.disable();
-        try {
-            assert.throws(function() {
-                rs.initiate();
-            });
-        } finally {
-            ReplSetTest.kDefaultTimeoutMS = oldTimeout;
-            MongoRunner.runHangAnalyzer.enable();
-        }
-        TestData.skipCheckDBHashes = true;
-    }
-    rs.stopSet();
-    TestData.skipCheckDBHashes = origSkipCheck;
-}
-
-// ca.pem signed client.pem and server.pem
-// trusted-ca.pem signed trusted-client.pem and trusted-server.pem
-
-// Sanity check that ca.pem can be used to properly authenticate.
-const options_manual_systemca = {
-    tlsMode: 'requireTLS',
-    tlsCAFile: 'jstests/libs/ca.pem',
-    tlsCertificateKeyFile: 'jstests/libs/server.pem',
-
-};
-testRS(options_manual_systemca, true);
-
-// Ensure that we can authenticate with system CA.
-const options_systemca = {
-    tlsMode: 'requireTLS',
-    tlsCertificateKeyFile: 'jstests/libs/server.pem',
-    setParameter: {tlsUseSystemCA: true},
-};
-testRS(options_systemca, true);
-
-// Sanity check that ca.pem can be used to properly fail to authenticate.
-const options_manual_systemca_nomatch = {
-    tlsMode: 'requireTLS',
-    tlsCAFile: 'jstests/libs/ca.pem',
-    tlsCertificateKeyFile: 'jstests/libs/trusted-server.pem',
-};
-testRS(options_manual_systemca_nomatch, false);
-
-// Ensure that we can properly fail to authenticate with system CA.
-const options_systemca_nomatch = {
-    tlsMode: 'requireTLS',
-    tlsCertificateKeyFile: 'jstests/libs/trusted-server.pem',
-    setParameter: {tlsUseSystemCA: true},
-};
-
-testRS(options_systemca_nomatch, false);
-}());
diff --git a/jstests/ssl/repl_ssl_noca.js b/jstests/ssl/repl_ssl_noca.js
new file mode 100644
index 00000000000..258530ccc9a
--- /dev/null
+++ b/jstests/ssl/repl_ssl_noca.js
@@ -0,0 +1,56 @@
+(function() {
+'use strict';
+if (_isWindows()) {
+    // OpenSSL backed imports Root CA and intermediate CA
+    runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
+
+    // SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
+    // Current User.
+    runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
+}
+
+var replTest = new ReplSetTest({
+    name: "ssltest",
+    nodes: 1,
+    nodeOptions: {
+        sslMode: "requireSSL",
+        sslPEMKeyFile: "jstests/libs/trusted-server.pem",
+    },
+    host: "localhost",
+    useHostName: false,
+});
+
+replTest.startSet({
+    env: {
+        SSL_CERT_FILE: 'jstests/libs/trusted-ca.pem',
+    },
+});
+replTest.initiate();
+
+var nodeList = replTest.nodeList().join();
+
+var checkShellOkay = function(url) {
+    // Should not be able to authenticate with x509.
+    // Authenticate call will return 1 on success, 0 on error.
+    var argv = ['mongo', url, '--eval', ('db.runCommand({replSetGetStatus: 1})')];
+    if (!_isWindows()) {
+        // On Linux we override the default path to the system CA store to point to our
+        // "trusted" CA. On Windows, this CA will have been added to the user's trusted CA list
+        argv.unshift("env", "SSL_CERT_FILE=jstests/libs/trusted-ca.pem");
+    }
+    return runMongoProgram(...argv);
+};
+
+var noMentionSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}`;
+jsTestLog(`Replica set url (doesn't mention SSL): ${noMentionSSLURL}`);
+assert.neq(checkShellOkay(noMentionSSLURL), 0, "shell correctly failed to connect without SSL");
+
+var useSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}&ssl=true`;
+jsTestLog(`Replica set url (uses SSL): ${useSSLURL}`);
+assert.eq(checkShellOkay(useSSLURL), 0, "successfully connected with SSL");
+
+var disableSSLURL = `mongodb://${nodeList}/admin?replicaSet=${replTest.name}&ssl=false`;
+jsTestLog(`Replica set url (doesnt use SSL): ${disableSSLURL}`);
+assert.neq(checkShellOkay(disableSSLURL), 0, "shell correctly failed to connect without SSL");
+replTest.stopSet();
+})();
diff --git a/jstests/ssl/repl_ssl_split_horizon.js b/jstests/ssl/repl_ssl_split_horizon.js
index 08cb9422a23..44f6fc8f9d2 100644
--- a/jstests/ssl/repl_ssl_split_horizon.js
+++ b/jstests/ssl/repl_ssl_split_horizon.js
@@ -76,7 +76,6 @@ var replTest = new ReplSetTest({
     nodeOptions: {
         sslMode: "requireSSL",
         sslPEMKeyFile: "jstests/libs/splithorizon-server.pem",
-        setParameter: {tlsUseSystemCA: true},
     },
     host: "localhost",
     useHostName: false,
@@ -84,7 +83,7 @@ var replTest = new ReplSetTest({
 
 replTest.startSet({
     env: {
-        SSL_CERT_FILE: 'jstests/libs/ca.pem',
+        SSL_CERT_FILE: 'jstests/libs/splithorizon-ca.pem',
     },
 });
 
@@ -119,11 +118,8 @@ var checkExpectedHorizon = function(url, memberIndex, expectedHostname) {
     var argv = [
         'env',
         "HOSTALIASES=" + hostsFile,
-        "SSL_CERT_FILE=jstests/libs/ca.pem",
+        "SSL_CERT_FILE=jstests/libs/splithorizon-ca.pem",
         'mongo',
-        '--tls',
-        '--tlsCertificateKeyFile',
-        'jstests/libs/splithorizon-server.pem',
         url,
         '--eval',
         assertion
diff --git a/jstests/ssl/ssl_ECDHE_suites.js b/jstests/ssl/ssl_ECDHE_suites.js
index 3436fa2fd44..b132948b93b 100644
--- a/jstests/ssl/ssl_ECDHE_suites.js
+++ b/jstests/ssl/ssl_ECDHE_suites.js
@@ -37,8 +37,7 @@ const mongod = MongoRunner.runMongod(x509_options);
 // Use new toolchain python, if it exists
 let python_binary = '/opt/mongodbtoolchain/v3/bin/python3';
 if (runProgram('/bin/sh', '-c', 'ls ' + python_binary) !== 0) {
-    // We are running on mac
-    python_binary = 'python3';
+    python_binary = '/opt/mongodbtoolchain/v3/bin/python3';
 }
 
 // Run the tls cipher suite enumerator
diff --git a/jstests/ssl/ssl_ca_options.js b/jstests/ssl/ssl_ca_options.js
deleted file mode 100644
index adcc7fefc9a..00000000000
--- a/jstests/ssl/ssl_ca_options.js
+++ /dev/null
@@ -1,69 +0,0 @@
-var SERVER_CERT = "jstests/libs/server.pem";
-var CA_CERT = "jstests/libs/ca.pem";
-
-// Neither tlsCAFile nor tlsUseSystemCA
-var opts = {
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-};
-assert.throws(() => MongoRunner.runMongod(opts),
-              [],
-              "MongoD started successfully with neither tlsCAFile nor tlsUseSystemCA");
-assert(rawMongoProgramOutput().includes(
-    "The use of TLS without specifying a chain of trust is no longer supported"));
-clearRawMongoProgramOutput();
-
-// Both tlsCAFile and tlsUseSystemCA
-opts = {
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-    tlsCAFile: CA_CERT,
-    setParameter: {tlsUseSystemCA: true},
-};
-assert.throws(() => MongoRunner.runMongod(opts),
-              [],
-              "MongoD started successfully with both tlsCAFile and tlsUseSystemCA");
-assert(rawMongoProgramOutput().includes(
-    "The use of both a CA File and the System Certificate store is not supported"));
-clearRawMongoProgramOutput();
-
-// Both tlsCAFile and tlsUseSystemCA, also tlsClusterCAFile (which is OK)
-opts = {
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-    tlsCAFile: CA_CERT,
-    tlsClusterCAFile: CA_CERT,
-    setParameter: {tlsUseSystemCA: true},
-};
-assert.throws(() => MongoRunner.runMongod(opts),
-              [],
-              "MongoD started successfully with both tlsCAFile and tlsUseSystemCA");
-assert(rawMongoProgramOutput().includes(
-    "The use of both a CA File and the System Certificate store is not supported"));
-clearRawMongoProgramOutput();
-
-// tlsClusterCAFile without tlsCAFile
-opts = {
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-    tlsClusterCAFile: CA_CERT,
-};
-assert.throws(() => MongoRunner.runMongod(opts),
-              [],
-              "MongoD started successfully with tlsClusterCAFile without tlsCAFile");
-assert(rawMongoProgramOutput().includes(
-    "Specifying a tlsClusterCAFile requires a tlsCAFile also be specified"));
-clearRawMongoProgramOutput();
-
-// tlsClusterCAFile without tlsCAFile, also tlsSystemCA (which is ignored in favor of former error)
-opts = {
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-    tlsClusterCAFile: CA_CERT,
-    setParameter: {tlsUseSystemCA: true},
-};
-assert.throws(() => MongoRunner.runMongod(opts),
-              [],
-              "MongoD started successfully with tlsClusterCAFile without tlsCAFile");
-assert(rawMongoProgramOutput().includes(
-    "Specifying a tlsClusterCAFile requires a tlsCAFile also be specified"));
\ No newline at end of file
diff --git a/jstests/ssl/ssl_cert_selector.js b/jstests/ssl/ssl_cert_selector.js
new file mode 100644
index 00000000000..f53c784f799
--- /dev/null
+++ b/jstests/ssl/ssl_cert_selector.js
@@ -0,0 +1,56 @@
+/**
+ * Validate that the shell can load certificates from the certificate store and connect to the
+ * server.
+ */
+
+load('jstests/ssl/libs/ssl_helpers.js');
+
+requireSSLProvider('windows', function() {
+    'use strict';
+
+    if (_isWindows()) {
+        // SChannel backed follows Windows rules and only trusts Root in LocalMachine
+        runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
+
+        // Import a pfx file since it contains both a cert and private key and is easy to import
+        // via command line.
+        runProgram("certutil.exe",
+                   "-importpfx",
+                   "-f",
+                   "-p",
+                   "qwerty",
+                   "jstests\\libs\\trusted-client.pfx");
+    }
+
+    const conn = MongoRunner.runMongod(
+        {sslMode: 'requireSSL', sslPEMKeyFile: "jstests\\libs\\trusted-server.pem"});
+
+    const testWithCert = function(certSelector) {
+        jsTest.log(`Testing with SSL cert ${certSelector}`);
+        const argv = [
+            'mongo',
+            '--ssl',
+            '--sslCertificateSelector',
+            certSelector,
+            '--port',
+            conn.port,
+            '--eval',
+            'db.runCommand({buildInfo: 1})'
+        ];
+
+        const exitStatus = runMongoProgram.apply(null, argv);
+        assert.eq(exitStatus, 0, "successfully connected with SSL");
+    };
+
+    const trusted_client_thumbprint = cat('jstests/libs/trusted-client.pem.digest.sha1');
+
+    assert.doesNotThrow(function() {
+        testWithCert("thumbprint=" + trusted_client_thumbprint);
+    });
+
+    assert.doesNotThrow(function() {
+        testWithCert("subject=Trusted Kernel Test Client");
+    });
+
+    MongoRunner.stopMongod(conn);
+});
diff --git a/jstests/ssl/ssl_cert_selector_apple.js b/jstests/ssl/ssl_cert_selector_apple.js
index 4aa5f00e9da..dd3d2e5912f 100644
--- a/jstests/ssl/ssl_cert_selector_apple.js
+++ b/jstests/ssl/ssl_cert_selector_apple.js
@@ -81,7 +81,7 @@ requireSSLProvider('apple', function() {
             sslCertificateSelector: cert.selector,
             sslClusterCertificateSelector: cluster.selector,
             waitForConnect: false,
-            setParameter: {logLevel: '1', tlsUseSystemCA: true},
+            setParameter: {logLevel: '1'},
         };
         clearRawMongoProgramOutput();
         const mongod = MongoRunner.runMongod(opts);
diff --git a/jstests/ssl/ssl_client_bad_certificate_warning.js b/jstests/ssl/ssl_client_bad_certificate_warning.js
deleted file mode 100644
index 0952f99645d..00000000000
--- a/jstests/ssl/ssl_client_bad_certificate_warning.js
+++ /dev/null
@@ -1,62 +0,0 @@
-// Test mongo shell output logs correct messages when not including certificates or using bad
-// certificates.
-(function() {
-'use strict';
-
-const SERVER_CERT = "jstests/libs/server.pem";
-const CA_CERT = "jstests/libs/ca.pem";
-
-const BAD_CLIENT_CERT = 'jstests/libs/trusted-client.pem';
-
-function testConnect(outputLog, ...args) {
-    const command = ['mongo', '--host', 'localhost', '--port', mongod.port, '--tls', ...args];
-
-    clearRawMongoProgramOutput();
-    const clientPID = _startMongoProgram({args: command});
-
-    assert.soon(function() {
-        const output = rawMongoProgramOutput();
-        if (output.includes(outputLog)) {
-            stopMongoProgramByPid(clientPID);
-            return true;
-        }
-        return false;
-    });
-}
-
-function runTests() {
-    // --tlsCertificateKeyFile not specifed when mongod was started with --tlsCAFile or
-    // --tlsClusterCAFile.
-    testConnect('No SSL certificate provided by peer', '--tlsCAFile', CA_CERT);
-
-    // Certificate not signed by CA_CERT used.
-    testConnect('SSL peer certificate validation failed',
-                '--tlsCAFile',
-                CA_CERT,
-                '--tlsCertificateKeyFile',
-                BAD_CLIENT_CERT);
-}
-
-// Use tlsClusterCAFile
-let mongod = MongoRunner.runMongod({
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-    tlsClusterCAFile: CA_CERT,
-    tlsCAFile: CA_CERT,
-});
-
-runTests();
-
-MongoRunner.stopMongod(mongod);
-
-// Use tlsCAFile
-mongod = MongoRunner.runMongod({
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: SERVER_CERT,
-    tlsCAFile: CA_CERT,
-});
-
-runTests();
-
-MongoRunner.stopMongod(mongod);
-})();
diff --git a/jstests/ssl/ssl_count_protocols.js b/jstests/ssl/ssl_count_protocols.js
index 04ab15b0e03..80426002c29 100644
--- a/jstests/ssl/ssl_count_protocols.js
+++ b/jstests/ssl/ssl_count_protocols.js
@@ -32,7 +32,6 @@ function runTestWithoutSubset(client) {
         sslDisabledProtocols: 'none',
         useLogFiles: true,
         tlsLogVersions: "TLS1_0,TLS1_1,TLS1_2,TLS1_3",
-        tlsCAFile: CA_CERT
     });
 
     print(disabledProtocols);
diff --git a/jstests/ssl/ssl_fragment.js b/jstests/ssl/ssl_fragment.js
index fb31769dc35..e585b9ac706 100644
--- a/jstests/ssl/ssl_fragment.js
+++ b/jstests/ssl/ssl_fragment.js
@@ -24,16 +24,12 @@ let options = {
     sslMode: "requireSSL",
     sslPEMKeyFile: "jstests/libs/server.pem",
     networkMessageCompressors: 'disabled',
-    tlsCAFile: 'jstests/libs/ca.pem',
-    sslAllowInvalidCertificates: ""
 };
 
 let mongosOptions = {
     sslMode: "requireSSL",
     sslPEMKeyFile: "jstests/libs/server.pem",
     networkMessageCompressors: 'disabled',
-    tlsCAFile: 'jstests/libs/ca.pem',
-    sslAllowInvalidCertificates: ""
 };
 
 if (_isWindows()) {
diff --git a/jstests/ssl/ssl_ingress_conn_metrics.js b/jstests/ssl/ssl_ingress_conn_metrics.js
deleted file mode 100644
index 729b3d21674..00000000000
--- a/jstests/ssl/ssl_ingress_conn_metrics.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Tests ingress connection metrics.
- *
- * @tags: [requires_fcv_60]
- */
-
-"use strict";
-
-(function() {
-load("jstests/ssl/libs/ssl_helpers.js");
-
-if (detectDefaultTLSProtocol() !== "TLS1_3") {
-    // Short-circuit and exit test immediately -- before TLS 1.3, we can't use
-    // opensslCipherSuiteConfig.
-    jsTestLog("Platform does not support TLS 1.3; skipping test.");
-    return;
-}
-
-// We use 'opensslCipherSuiteConfig' to deterministically set the cipher suite negotiated when
-// openSSL is being used. This can be different on Windows/OSX implementations.
-let cipherSuite = "TLS_AES_256_GCM_SHA384";
-
-const tlsOptions = {
-    tlsMode: "requireTLS",
-    tlsCertificateKeyFile: "jstests/libs/server.pem",
-    tlsCAFile: "jstests/libs/ca.pem",
-    setParameter: {opensslCipherSuiteConfig: cipherSuite},
-};
-
-// Get the logId that corresponds to the implementation of TLS being used.
-let logId;
-switch (determineSSLProvider()) {
-    case "openssl":
-        logId = 6723801;
-        break;
-    case "windows":
-        logId = 6723802;
-        // This cipher is chosen to represent the cipher negotiated by Windows Server 2019 by
-        // default.
-        cipherSuite = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
-        break;
-    case "apple":
-        logId = 6723803;
-        // We log only the cipher represented as its enum value in this code path. This corresponds
-        // to the hex value 0xC030 which maps to the cipher suite
-        // "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384". This cipher is chosen by OSX 12.1 by default.
-        cipherSuite = 49200;
-        break;
-    default:
-        assert(false, "Failed to determine that we are using a supported SSL provider");
-}
-
-jsTestLog("Establishing connection to mongod");
-const mongod = MongoRunner.runMongod(Object.merge(tlsOptions));
-// Start a new connection to check that 'durationMicros' is cumulatively measured in server status
-assert.soon(() => checkLog.checkContainsOnceJson(mongod, logId, {"cipher": cipherSuite}),
-            "failed waiting for log line with negotiated cipher info");
-
-MongoRunner.stopMongod(mongod);
-}());
diff --git a/jstests/ssl/ssl_invalid_server_cert.js b/jstests/ssl/ssl_invalid_server_cert.js
index 71d9aee8254..6bb8cef2c57 100644
--- a/jstests/ssl/ssl_invalid_server_cert.js
+++ b/jstests/ssl/ssl_invalid_server_cert.js
@@ -41,5 +41,5 @@ runTest('expired', expired, validityMessage);
 
 // Test that startup fails with no certificate at all.
 const needKeyFile = 'need tlsCertificateKeyFile or certificateSelector when TLS is enabled';
-runTest('no-key-file', {tlsMode: 'requireTLS', tlsCAFile: 'jstests/libs/ca.pem'}, needKeyFile);
+runTest('no-key-file', {tlsMode: 'requireTLS'}, needKeyFile);
 })();
diff --git a/jstests/ssl/ssl_restricted_protocols.js b/jstests/ssl/ssl_restricted_protocols.js
index de971b945a4..1ea7c0dd209 100644
--- a/jstests/ssl/ssl_restricted_protocols.js
+++ b/jstests/ssl/ssl_restricted_protocols.js
@@ -10,12 +10,8 @@ var CA_CERT = "jstests/libs/ca.pem";
 
 function runTestWithoutSubset(subset) {
     const disabledProtocols = subset.join(",");
-    const conn = MongoRunner.runMongod({
-        sslMode: 'allowSSL',
-        sslPEMKeyFile: SERVER_CERT,
-        sslDisabledProtocols: disabledProtocols,
-        tlsCAFile: CA_CERT
-    });
+    const conn = MongoRunner.runMongod(
+        {sslMode: 'allowSSL', sslPEMKeyFile: SERVER_CERT, sslDisabledProtocols: disabledProtocols});
 
     const exitStatus = runMongoProgram('mongo',
                                        '--ssl',
diff --git a/jstests/ssl/ssl_with_system_ca.js b/jstests/ssl/ssl_with_system_ca.js
new file mode 100644
index 00000000000..4626cceeaa9
--- /dev/null
+++ b/jstests/ssl/ssl_with_system_ca.js
@@ -0,0 +1,54 @@
+// On OSX this test assumes that jstests/libs/trusted-ca.pem has been added as a trusted
+// certificate to the login keychain of the evergreen user. See,
+// https://github.com/10gen/buildslave-cookbooks/commit/af7cabe5b6e0885902ebd4902f7f974b64cc8961
+// for details.
+// To install trusted-ca.pem for local testing on OSX, invoke the following at a console:
+//   security add-trusted-cert -d jstests/libs/trusted-ca.pem
+(function() {
+'use strict';
+
+const HOST_TYPE = getBuildInfo().buildEnvironment.target_os;
+if (HOST_TYPE == "windows") {
+    // OpenSSL backed imports Root CA and intermediate CA
+    runProgram("certutil.exe", "-addstore", "-user", "-f", "CA", "jstests\\libs\\trusted-ca.pem");
+
+    // SChannel backed follows Windows rules and only trusts the Root store in Local Machine and
+    // Current User.
+    runProgram("certutil.exe", "-addstore", "-f", "Root", "jstests\\libs\\trusted-ca.pem");
+}
+
+function testWithCerts(prefix) {
+    jsTest.log(
+        `Testing with SSL certs $ {
+            clientPem connecting to serverPem
+        }`);
+
+    // allowSSL to get a non-SSL control connection.
+    const conn = MongoRunner.runMongod(
+        {sslMode: 'allowSSL', sslPEMKeyFile: 'jstests/libs/' + prefix + 'server.pem'});
+
+    let argv = [
+        'mongo',
+        '--ssl',
+        '--port',
+        conn.port,
+        '--sslPEMKeyFile',
+        'jstests/libs/' + prefix + 'client.pem',
+        '--eval',
+        ';'
+    ];
+
+    if (HOST_TYPE == "linux") {
+        // On Linux we override the default path to the system CA store to point to our
+        // "trusted" CA. On Windows, this CA will have been added to the user's trusted CA list
+        argv.unshift("env", "SSL_CERT_FILE=jstests/libs/trusted-ca.pem");
+    }
+
+    const exitCode = runMongoProgram.apply(null, argv);
+    MongoRunner.stopMongod(conn);
+    return exitCode;
+}
+
+assert.neq(0, testWithCerts(''), 'Certs signed with untrusted CA');
+assert.eq(0, testWithCerts('trusted-'), 'Certs signed with trusted CA');
+})();
diff --git a/jstests/ssl/ssl_mongodb_x509.js b/jstests/ssl/ssl_without_ca.js
index cfb02724084..9b0a62a5250 100644
--- a/jstests/ssl/ssl_mongodb_x509.js
+++ b/jstests/ssl/ssl_without_ca.js
@@ -5,8 +5,7 @@ var CLIENT_USER = "C=US,ST=New York,L=New York City,O=MongoDB,OU=KernelUser,CN=c
 jsTest.log("Assert x509 auth is not allowed when a standalone mongod is run without a CA file.");
 
 // allowSSL instead of requireSSL so that the non-SSL connection succeeds.
-var conn = MongoRunner.runMongod(
-    {sslMode: 'allowSSL', sslPEMKeyFile: SERVER_CERT, auth: '', tlsCAFile: 'jstests/libs/ca.pem'});
+var conn = MongoRunner.runMongod({sslMode: 'allowSSL', sslPEMKeyFile: SERVER_CERT, auth: ''});
 
 var external = conn.getDB('$external');
 external.createUser({
@@ -31,20 +30,13 @@ var exitStatus = runMongoProgram('mongo',
                                   'user: "' + CLIENT_USER + '" ,' +
                                   'mechanism: "MONGODB-X509"}));'));
 
-jsTest.log("exitStatus: " + exitStatus);
-
 assert.eq(exitStatus, 0, "authentication via MONGODB-X509 without CA succeeded");
 
 MongoRunner.stopMongod(conn);
 
 jsTest.log("Assert mongod doesn\'t start with CA file missing and clusterAuthMode=x509.");
 
-var sslParams = {
-    clusterAuthMode: 'x509',
-    sslMode: 'requireSSL',
-    setParameter: {tlsUseSystemCA: true},
-    sslPEMKeyFile: SERVER_CERT
-};
+var sslParams = {clusterAuthMode: 'x509', sslMode: 'requireSSL', sslPEMKeyFile: SERVER_CERT};
 assert.throws(() => MongoRunner.runMongod(sslParams),
               [],
               "server started with x509 clusterAuthMode but no CA file");
@@ -64,12 +56,10 @@ var startOptions = {
     configsvr: "",
     storageEngine: "wiredTiger",
     sslMode: 'allowSSL',
-    sslPEMKeyFile: 'jstests/libs/trusted-server.pem',
-    tlsCAFile: 'jstests/libs/ca.pem'
+    sslPEMKeyFile: 'jstests/libs/trusted-server.pem'
 };
 
 var configRS = new ReplSetTest(rstOptions);
-
 configRS.startSet(startOptions);
 
 // Make sure the mongoS failed to start up for the proper reason.
diff --git a/jstests/ssl/x509/certs.yml b/jstests/ssl/x509/certs.yml
index e0aae5afd1b..b2f50d283ba 100644
--- a/jstests/ssl/x509/certs.yml
+++ b/jstests/ssl/x509/certs.yml
@@ -528,26 +528,6 @@ certs:
     keyUsage: [digitalSignature, keyEncipherment]
     extendedKeyUsage: [serverAuth, clientAuth]
 
-- name: 'server_ocsp_invalid.pem'
-  description: >-
-    An expired OCSP certificate for the mongodb server.
-  Subject:
-    CN: 'badHost'
-    C: US
-    ST: NY
-    L: OCSP-1
-  Issuer: 'ca_ocsp.pem'
-  include_header: false
-  output_path: 'jstests/libs/ocsp/'
-  extensions:
-    basicConstraints: {CA: false}
-    subjectAltName:
-      DNS: badHost
-    authorityInfoAccess: 'OCSP;URI:http://localhost:8100/status'
-    subjectKeyIdentifier: hash
-    keyUsage: [digitalSignature, keyEncipherment]
-    extendedKeyUsage: [serverAuth, clientAuth]
-
 - name: 'server_ocsp_revoked.pem'
   description: >-
     OCSP certificate for the mongodb server.
@@ -768,10 +748,19 @@ certs:
 # Split Horizon
 ###
 
+- name: 'splithorizon-ca.pem'
+  description: CA for split horizon testing.
+  Subject: {O: 'MongoDB, Inc.', CN: 'Kernel Split Horizon Test CA'}
+  Issuer: self
+  extensions:
+    subjectKeyIdentifier: hash
+    authorityKeyIdentifier: keyid
+    basicConstraints: {CA: true}
+
 - name: 'splithorizon-server.pem'
   description: Server certificate for split horizon testing.
   Subject: {O: 'MongoDB, Inc. (Splithorizon)', CN: 'server'}
-  Issuer: 'ca.pem'
+  Issuer: 'splithorizon-ca.pem'
   extensions:
     extendedKeyUsage: [serverAuth, clientAuth]
     subjectAltName:
diff --git a/jstests/ssl/x509/mkcert.py b/jstests/ssl/x509/mkcert.py
index 69b0f571287..45ac802e51c 100755
--- a/jstests/ssl/x509/mkcert.py
+++ b/jstests/ssl/x509/mkcert.py
@@ -1,8 +1,7 @@
 #!/usr/bin/env python3
 """
 This script (re)generates x509 certificates from a definition file.
-Invoke as `python3 jstests/ssl/x509/mkcert.py --config jstests/ssl/x509/certs.yml`
-and `python3 jstests/ssl/x509/mkcert.py --config src/mongo/db/modules/enterprise/jstests/libs/certs.yml`
+Invoke as `python3 jstests/ssl/x509/mkcert.py --config certs.yml`
 Optionally providing a cert ID to only regenerate a single cert.
 """
 import argparse
@@ -408,25 +407,10 @@ def convert_cert_to_pkcs12(cert):
     ca = get_cert_path(cert['Issuer'])
     passout = 'pass:' + pkcs12['passphrase']
 
-    args = [
-        "openssl",
-        "pkcs12",
-        "-legacy",
-        "-export",
-        "-in",
-        src,
-        "-inkey",
-        src,
-        "-out",
-        dest,
-        "-passout",
-        passout,
-        "-certfile",
-        ca,
-    ]
-    if cert.get("passphrase"):
-        args.append("-passin")
-        args.append("pass:" + cert["passphrase"])
+    args = ['openssl', 'pkcs12', '-export', '-in', src, '-inkey', src, '-out', dest, '-passout', passout, '-certfile', ca]
+    if cert.get('passphrase'):
+        args.append('-passin')
+        args.append('pass:' + cert['passphrase'])
 
     subprocess.check_call(args)
 
diff --git a/jstests/ssl/x509/root-and-trusted-ca.pem b/jstests/ssl/x509/root-and-trusted-ca.pem
index 50c9262556c..18882c21d68 100644
--- a/jstests/ssl/x509/root-and-trusted-ca.pem
+++ b/jstests/ssl/x509/root-and-trusted-ca.pem
@@ -5,46 +5,46 @@
 
 # Certificate from ca.pem
 -----BEGIN CERTIFICATE-----
-MIIDeTCCAmGgAwIBAgIEIGnWnzANBgkqhkiG9w0BAQsFADB0MQswCQYDVQQGEwJV
+MIIDeTCCAmGgAwIBAgIEe9SskzANBgkqhkiG9w0BAQsFADB0MQswCQYDVQQGEwJV
 UzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5ldyBZb3JrIENpdHkxEDAO
 BgNVBAoMB01vbmdvREIxDzANBgNVBAsMBktlcm5lbDEXMBUGA1UEAwwOS2VybmVs
-IFRlc3QgQ0EwHhcNMjQwNjA1MTYxNDQ2WhcNMjYwOTA3MTYxNDQ2WjB0MQswCQYD
+IFRlc3QgQ0EwHhcNMjIwMTI3MjE1OTQyWhcNMjQwNDMwMjE1OTQyWjB0MQswCQYD
 VQQGEwJVUzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5ldyBZb3JrIENp
 dHkxEDAOBgNVBAoMB01vbmdvREIxDzANBgNVBAsMBktlcm5lbDEXMBUGA1UEAwwO
-S2VybmVsIFRlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDU
-tM92EQ+UJAvDZHjcHGCM5M2E/wHRXWV6z3pXNT+cZliEsUbCBqwA+rs3KYyT0NxM
-2bxDo7/yplFGEb8Kz3gZJGiXcp0WEqZKN8yfTd6p2OTzSlQ/Yw4wcsfnhDX/i2HK
-NQVh258vf1e4t8spr3udsPnfQo0ap/28F3Jq2QxGmKiTPQ2xdyWvk/K5zABHX4mu
-3c29FdViZpcYoKCdYhIsO7IWPBvvPQEqRDPRU/UDweYbJFyrlWNWMCislj0EfGIn
-LBhtXxeZHIXh9fWO8DfMzER+r1fIhxX7lvzdpyT+t3NcOGSWYRKcG8q2+iUnCK4H
-2a2Vg5YKQYGGWmkEQ++XAgMBAAGjEzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
-hvcNAQELBQADggEBAMjiHKAOjasqJPeqSaibtcpClQ2qK6xVMvAdX2YofNzO9/WD
-T1vqF06nuUlUTN+onacW9bT/cABzX2WmBlXH3N0kkr3bQ3dZy6KJpZnLhat3TLYd
-pYWbbVvHUJ31DGnZXNpWzvH/7KSK/IUixfjlYXaKocRNacXtRlidKN1IgTjaMNvL
-gTGaeiaylRYQ0wwirxVJWUzCkRahVlu8nHipl4oWoRfzCxeKGLpXWPBBVJPmupxJ
-qeU0X4fppEYMfXBZLoA5XFPeGcA+epZxNCOEP9f+0CxLmJibe/IUWRcNPS2WWznT
-MV/vxlcqKt0YqxFFk8LzbYMfKa4RXKvk/xpy87g=
+S2VybmVsIFRlc3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDf
+vZIt82obTHnc3iHgUYSc+yVkCHyERF3kdcTTFszDbN9mVPL5ZkH9lIAC3A2rj24T
+pItMW1N+zOaLHU5tJB9VnCnKSFz5CHd/KEcLA3Ql2K70z7n1FvINnBmqAQdgPcPu
+Et2rFgGg3atR3T3bV7ZRlla0CcoAFl/YoDI16oHRXboxAtoAzaIwvS6HUrOYQPYq
+BLGt00Wws4bpILk3b04lDLEHmzDe6N3/v3FgBurPzR2tL97/sJGePE94I833hYG4
+vBdU0Kdt9FbTDEFOgrfRCisHyZY6Vw6rIiWBSLUBCjtm2vipgoD0H3DvyZLbMQRr
+qmctCX4KQtOZ8dV3JQkNAgMBAAGjEzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggEBAJnz4lK9GiCWhCXIPzghYRRheYWL8nhkZ+3+oC1B3/mGEf71
+2VOdND6fMPdHinD8jONH75mOpa7TanriVYX3KbrQ4WABFNJMX9uz09F+0A2D5tyc
+iDkldnei+fiX4eSx80oCPgvaxdJWauiTsEi+fo2Do47PYkch9+BDXT9F/m3S3RRW
+cia7URBAV8Itq6jj2BHcpS/dEqZcmN9kGWujVagcCorc0wBKSmkO/PZIjISid+TO
+Db2g+AvqSBDU0lbdP7NXRSIxvZejDz4qMjcpSbhW9OS2BCYZcq5wgH2lwYkdPtmX
+JkhxWKwsW11WJWDcmaXcffO3a6lDizxyjnTedoU=
 -----END CERTIFICATE-----
 # Certificate from trusted-ca.pem
 -----BEGIN CERTIFICATE-----
-MIIDojCCAoqgAwIBAgIEDSAeGjANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV
+MIIDojCCAoqgAwIBAgIEclbQATANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV
 UzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5ldyBZb3JrIENpdHkxEDAO
 BgNVBAoMB01vbmdvREIxDzANBgNVBAsMBktlcm5lbDEfMB0GA1UEAwwWVHJ1c3Rl
-ZCBLZXJuZWwgVGVzdCBDQTAeFw0yNDA2MDUxNjE0NDlaFw0yNjA5MDcxNjE0NDla
+ZCBLZXJuZWwgVGVzdCBDQTAeFw0yMjAxMjcyMTU5NDhaFw0yNDA0MzAyMTU5NDha
 MHwxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhOZXcgWW9yazEWMBQGA1UEBwwNTmV3
 IFlvcmsgQ2l0eTEQMA4GA1UECgwHTW9uZ29EQjEPMA0GA1UECwwGS2VybmVsMR8w
 HQYDVQQDDBZUcnVzdGVkIEtlcm5lbCBUZXN0IENBMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAyfVq3WLPJGI78RjLcU6TWsL67KzIA5FH5Cs2VLttWK+f
-zDwGKdbn3UBbsL+jw0Ixfe7lv5EZXABXVb4sYJ2zZLojwnBjnbfcTuaS/aYJe5Sd
-nExjhEGErTu3gD0ErXD3Zf+nQMlqTw0B870TkRDyuU3ZNwkGcJYPnWbM+iktHPoq
-JQ6IzxUFYgas0TfwBlDOOSbJSW9wHQO7vmg3xQGt7/dj2E8NpWFXBbxC91RFEmbv
-+v3cbwwhYLogIAZTFsL4AcTrEpbmcR8f2B27gZlCGelMi/C+KAcHeEwHbHokY/A8
-DeBSpkAS8eCU/A434hb9tNKNy9pQpreV+qyfYaSSSwIDAQABoywwKjAMBgNVHRME
+AAOCAQ8AMIIBCgKCAQEA8h+5axgTodw8KmHz/rcPcy2N/etFkipOVL0i3Ug6JcKk
+DjuSIdyLULuIQlR8nXWQ3hW9CZ2gDCeSnmnUKY6GWDQPHoSUJPhmGkXPuPBXivcL
+QpLVZeOHrqR4+SHzOA3317LF/QYm9kC3dEZIz+dWUlTHs4NFwR+Yo84XNosSGaUh
+o0mK5YcBx0W7y82rNrijcygOkXF9QrANUZfUz5uQ/ZPDjgoISqFvgMzJtpL6LqSC
+TbsUM4NbPSYECDFzIosO+rhYCUsgZ5pE6NWZjmKzq4+zeb/2iSIoEb7U/5f6i4H4
+880y+usrcsBuNCS1OVHaEB1ZrlinJbzplB3nV9Hj1wIDAQABoywwKjAMBgNVHRME
 BTADAQH/MBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG9w0BAQsF
-AAOCAQEAtWS7ufCbscbsvYef2HPkBK0By6HwMdaZDy90OckUvfOR8vUHH8FNfav/
-BUzIlDnO2lKFClvbeT584fDbYVqwQS3/6Pz2lyQ64vvKcmMHzqiA+nUW/DN1x92t
-KLbcs853RgDDz1XtXwMw2VvLC5gYWB6GZ+VVRWuLYgd/l0i+ckk3jG1F9+KPs8F0
-1CaSPkAX0HAaiiBXgNCWAm+z/JZO3fRwCo2s5hRBZ40d9ZprPJyH7n2x9Uyf6SP3
-7BfGakoer9LtraSaMnhrOHUMFuunVfOk/3wstu51sNcdDI5UpkJFZUwD8y7gyN2Z
-GQIsgSNXW4rN/5jamADn3WkC7bo2Tg==
+AAOCAQEArn+KmfD2JEXa0G81jY+v1+XBT4BCcFExbdpOYbIoo2m0Qvx+sla5+Qu7
+nG51R+3rnkVPr03ogKYtf3hYtQJk6DqfuF0V9ESYkz09XRwyW93mh3z4yumXnk3y
+d6SG2quC6iJV0EqT/OnmmveGBpxaBjf80ezRq+8t0mVGeNwZSxv0OprAkmKIIDM8
+Qa1/LlGhStiU+hN62c3m4wHdY5jreRYH7NyIZCHJ/wKgo0cDWWdJ4MeAaQhuijUI
+BaNg6mFHlxVMMRGIGSduUhu7vHzjbAES6kJxdIpDM8tZMlRZQ3ORml5s9onSMb2n
+NmJkjwyB62odD+yrygWRLtFMJmKODQ==
 -----END CERTIFICATE-----
diff --git a/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha1 b/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha1
index 094d60417bb..dbe9e3898af 100644
--- a/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha1
+++ b/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha1
@@ -1 +1 @@
-13D573B8FF4C9E4AAEF37A360BA2D52AAD8FAE48
\ No newline at end of file
+F42B9419C2EF9D431D7C0E5061A82902D385203A
\ No newline at end of file
diff --git a/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha256 b/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha256
index 7f833323449..2cffe1b5da9 100644
--- a/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha256
+++ b/jstests/ssl/x509/root-and-trusted-ca.pem.digest.sha256
@@ -1 +1 @@
-ABFD56D37533C4F7EE311891B1749818EDB90DEBFC957968A37066688598C607
\ No newline at end of file
+21A1C6A87B31AF590F5074EE716F193522B8F540081A5D571B25AE5DF72863E3
\ No newline at end of file
diff --git a/jstests/ssl/x509/trusted-client-testdb-roles.pem b/jstests/ssl/x509/trusted-client-testdb-roles.pem
index 14853dde7a6..6868581d6ca 100644
--- a/jstests/ssl/x509/trusted-client-testdb-roles.pem
+++ b/jstests/ssl/x509/trusted-client-testdb-roles.pem
@@ -3,53 +3,53 @@
 #
 # Client certificate with X509 role grants via trusted chain.
 -----BEGIN CERTIFICATE-----
-MIIDwzCCAqugAwIBAgIEVqMO+TANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV
+MIIDwzCCAqugAwIBAgIEIEan5jANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJV
 UzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5ldyBZb3JrIENpdHkxEDAO
 BgNVBAoMB01vbmdvREIxDzANBgNVBAsMBktlcm5lbDEfMB0GA1UEAwwWVHJ1c3Rl
-ZCBLZXJuZWwgVGVzdCBDQTAeFw0yNDA2MDUxNjE0NDlaFw0yNjA5MDcxNjE0NDla
+ZCBLZXJuZWwgVGVzdCBDQTAeFw0yMjAxMjcyMTU5NDhaFw0yNDA0MzAyMTU5NDha
 MIGRMQswCQYDVQQGEwJVUzERMA8GA1UECAwITmV3IFlvcmsxFjAUBgNVBAcMDU5l
 dyBZb3JrIENpdHkxEDAOBgNVBAoMB01vbmdvREIxFTATBgNVBAsMDEtlcm5lbCBV
 c2VyczEuMCwGA1UEAwwlVHJ1c3RlZCBLZXJuZWwgVGVzdCBDbGllbnQgV2l0aCBS
-b2xlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANqAeofH+37l6Xgb
-TOhL2jjl/obvUxu0VqNMczWYchJNaXxsx1Aa3CJvypjn76ZKVcXoFaJWXeAU3qv5
-Oz5rvdoxK3vwPzZSzW3pXL9lEtYWtC36fnmk1CHEa/n1p0S/kWb5KIG+dF9D+JYO
-dqB9chGRxrTu9m0N8doATtBB+q+twY4OyhTacfYJjuS/xlvagm29QLTjIFxSspjQ
-O38Ki9WHBVO4E8r4nu9BGzsjQ7R6+m+Zl+hTo6ao1bxBEZEi4vJpeW/AQZHJ8+LY
-Fs04/dulqQtNG/9olLiGVfZJGzLQq9jvDd6DZUP0jwy2qDT2CoLg9Prh0IskL/jr
-Uf1Nk2MCAwEAAaM3MDUwMwYLKwYBBAGCjikCAQEEJDEiMA8MBXJvbGUxDAZ0ZXN0
-REIwDwwFcm9sZTIMBnRlc3REQjANBgkqhkiG9w0BAQsFAAOCAQEAfeejZUGDGtRm
-Dge9Cd1IytzFav8yzm8u1Ed/930TWzlqycmwANdDSf8RnKLIxBc9PWemfs2z8JZK
-fVK84fOAJZkqyDEDzVSi04oSLawZHeu4uxg3BmiwWlUcAfAyhd4+83YZYy909tu7
-eAsP/xvmbAlSUrOQ+Vn1pXOohIl8sFocYFCW1fq5uKQc9xrRPi10MIJrlXsFr+SI
-PrUYQ2DTsEHDRqGgBa4YDYd2ysVtFXq6bHjTKd54978XaTeTqE4ZycFgMIzIK+Jo
-bzXAhGqA8JnP+iLKlLW+AWAR1j1l3nRiZdps1/6qlJr9SmPUhrWYXhYPd9Cl7RQf
-q426PcO0dg==
+b2xlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOpl8u+oSvvW1n2Q
+6+XzknlDB1C0zd8ztNiTjOdSD0Nv4OHQX++ft+t3ZFCKq5GM61LcDKoa6tKr3QXf
+lnHl1Ywz0swOXJ1L/FJuyM4FugSCpcWrD/zMPylrxTGWGW5YiiiwBvzh6ZZ40dVM
+VlP3oXcbl96/7EufJNYRYJVOQxMw+T4elZCC4J/keMb33daluwckouOSmOrQu9lx
+8croX81+uHUiHuTLH5XlIlLi/Z8BjuPwXt5JSxmHnc4cBhAC1fHjEDr/u85vfdTe
+5tn2PIdA9o5dOsU+IqNbvdW5KZ74G44QlRyGr8roj1SwHfIHvNZDYxrC2uXhOKoK
+1tRv11UCAwEAAaM3MDUwMwYLKwYBBAGCjikCAQEEJDEiMA8MBXJvbGUxDAZ0ZXN0
+REIwDwwFcm9sZTIMBnRlc3REQjANBgkqhkiG9w0BAQsFAAOCAQEAaEL9nJI66Qec
+7KnKysAi/uaEKIajs86bnb/nkUQJxDSEOb/YDi41LQ2D2+MX52b26GD4rUAHvkjU
+hHzCHprc2mgjWm0J7jCY8dlqj7ka9g5SWi56gDRfjSjuAOV93+Q4Ty/kAFLBIy8H
+z0v7ed+a14i6NHqAmZAXVx61zI6nZgDhN8kcuvJICQKTWk8rVp9Cv/OhntIJgU7z
+Lqqdn7eSOnwYllVG18dsQHOea6f6aCicbLDZgbSOnSPowhxMaPiIfq+WXXo1YiPl
+kRHxE9OVYuGaT7qTQoda/SNfotRNJ6ApbGZLjtCr3mVA0LoK8e2HWFmNqRIUUx37
+zecLCwDx3g==
 -----END CERTIFICATE-----
 -----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDagHqHx/t+5el4
-G0zoS9o45f6G71MbtFajTHM1mHISTWl8bMdQGtwib8qY5++mSlXF6BWiVl3gFN6r
-+Ts+a73aMSt78D82Us1t6Vy/ZRLWFrQt+n55pNQhxGv59adEv5Fm+SiBvnRfQ/iW
-DnagfXIRkca07vZtDfHaAE7QQfqvrcGODsoU2nH2CY7kv8Zb2oJtvUC04yBcUrKY
-0Dt/CovVhwVTuBPK+J7vQRs7I0O0evpvmZfoU6OmqNW8QRGRIuLyaXlvwEGRyfPi
-2BbNOP3bpakLTRv/aJS4hlX2SRsy0KvY7w3eg2VD9I8Mtqg09gqC4PT64dCLJC/4
-61H9TZNjAgMBAAECggEBANe86z6Nkh/lWfOg4PqrijeLvxfzzRcZpEFwBoDwmBDC
-JlkX/mN1Yc0Om/cFanXCB5Z0ZIf4xo+ti345gulK8BUzXz/sIj282+Cd/VlsroB7
-wkNzhNUOjfUZP5N5nUIf86y8beZM6hH1xshCV5Z2xd3bFVsoZl+e2SDqFOdDfgVd
-sj1ai+OserrZuhyoOx2jxc++do3ptLsa5thG8kEm5i7tbs6O0D0rrSkvlreW1WCI
-1Ws3FNa1YY44RXnMVO42HNRCu5FlvYSJpEwNxXeS2zusvslJP7Pt4g0bplgStPBM
-DjG00Gb264vRRRjPgXR2WiIJKGTvtzBbgx0peGq3MQECgYEA+8ln2cIp4veS0DZS
-RY2u5wJFXnZ0Q5ShI4zfoStiSPNcmGcU7wh3lHZT9yu/TYLCr6IubnTXIUwohrmJ
-KERIQBkVP9qHcNoB6bITEj2jN4EvlkKfmgKwczo+MputVzUu2y9wd/zKdd3lQkY+
-lRX85ltHukEacAsYFqPUwvtq8CECgYEA3ih9D6G72RrWDfyL0xp7ioE+CNbjtAsg
-BmK/lT8gtR3PudVmXWGn4cRohzz95yGiDOkwe5trcujzNvbfy5InvTAldoIl0FhM
-DFH2TnVARwQSrttyLRj58Fxgx5ogJyto4gfo88247NsZB1PEe/4zVce300EErqjF
-HEHf1GowYwMCgYB5la1ncyJE7qZfkwuxeJSQCwGyduL3y2rwvtMygb+pWJNLKOPr
-9ZvA/k7XmbF8XXtj0p43SoakFqGvRSLdZfO5uCMRvZYPwcaQsiQRd+A8Kk7vcWae
-uVO5oNNuHszawtzIjSTzXAfsWOWfVkpcNcz08/k0EMISftj3/c79BOmD4QKBgDiN
-YACZsEL9BN58mm97v1Urv0nqwf40EsvtWU25yy6vzxBEVZGR6XWcVOuQSCYNNr5I
-ojHlB34x9K/aOnAM3ZbYacD4Mn4N7BX6y1N/n4Q0cjkW3cLDJ+Ta7zwAbQzrjQB0
-+QUPKnMI9x8ZYNwbgp/kflQFqhZ4Ge0ui7b77SNXAoGBAK0i/7XpnmZ5ZGesCMtz
-8crwxtalotvpF5MhuM2hIe8RBE47c4bo1XrZk1Z9LUtlVwp/vcfJZn4gMsPoFUKI
-M+5iVWWhVRCmgAqUQBL9jXb0mpSCui4RPn/VZVrVkkS+17mFrO/dua8indMfWY05
-AulQhYcaDfjPk8GeHuuJZXp9
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDqZfLvqEr71tZ9
+kOvl85J5QwdQtM3fM7TYk4znUg9Db+Dh0F/vn7frd2RQiquRjOtS3AyqGurSq90F
+35Zx5dWMM9LMDlydS/xSbsjOBboEgqXFqw/8zD8pa8UxlhluWIoosAb84emWeNHV
+TFZT96F3G5fev+xLnyTWEWCVTkMTMPk+HpWQguCf5HjG993WpbsHJKLjkpjq0LvZ
+cfHK6F/Nfrh1Ih7kyx+V5SJS4v2fAY7j8F7eSUsZh53OHAYQAtXx4xA6/7vOb33U
+3ubZ9jyHQPaOXTrFPiKjW73VuSme+BuOEJUchq/K6I9UsB3yB7zWQ2Mawtrl4Tiq
+CtbUb9dVAgMBAAECggEAXvcfDenpN087Z3QnnuqoFWkKtbALGLsiMfzVwYKFnJTf
+T53UwIi9QzED+32zNS0ayl9M4j41lVT8Hz0O/uZXNo5ogTPwYeo/OEaaJJ49V0Z3
+UzaTK6C0lluLcSOW+hX1I7btndcJhGU+3mQnNa3GRTNwvFaVra20huZTcypaEpOm
+Xxo26QcJFloaMm2n7HAuO756HXd+63SqoQubMQxGFBga76H3ep3WTTgFR6VBejfb
+brdXwT0/uS/0rQ9hkcs/RFfqZqsI8ADXhqhu7aO1+xu5cdzGN6Oa6NKnh3tLX52v
+MQxurnWBIkZNKEczqfVwGWSnwdTlymS11ohleOGrAQKBgQD57xw9fU1VjZ5u4d7Q
+IYQTcBGEf4EHzmJNcXmvz5U98UmrVCuH0TGgMlUUs4LcdvPBbOhW74cfYXPSDQVF
+Afig77BGCn1o3/6T2VgYBJqf9OAMZC+mnMhEuWUcyCYTwmh8v/qHfuJbcADGtQ5B
+05OXKBkjtrBWTbdekis90mk52QKBgQDwFk/Nq2jkff7q/6HwiBXnphHnvl/QLSJl
+3dgNkICl+7HIVHCe+hhLEG5SlNx0drchFuYH2ZN/MMqeWju2oXgcBZmeULKct5VT
+Hii7B3fOkILPCaVJTDtgYMUHsdZ4j+HG7PsjB8/V8DzdijmKMaYb0ZmJmy01ipBv
+T8+XwvC/3QKBgQCJR4HOcG2yyTe1ldDJpy8hchPdIB+iRwUNnn+FRtKllEuvlGrY
+jdnhMOQ0m6kMKTYYDxbK8YPZg7CXNlmnnr6OvzimMArUOPxe/yl4/8Zih6EsjTbz
+H/iMbvyPw4vOnKDBrL0SAWqZaLq0aixrkafmhbrRN/5BWSyYAFdJ/LGZeQKBgDJt
+LUPQfc6IHDO1j4javGcUPWyEUtGBuVjV+JwYvryeGeAuxBzQAKw7fkCAHbGkgaBE
+k/oQG+e6EsShxSr9zSFtl69l2a4K7SUxD3MBBYvwVFkx+HJlvY7npFqSYq6d4dkL
+S1A3QtL3i4EomB9LgE0Vf/8kBaHaQa3vgHWqrzBNAoGBAKgqghZTroNcX91Mqu0p
+iriLMkiDqJkzehD9XQMhOjMfoGxyMoYFmrvo5UHSOEl6ztMFBwR5j6S8hwDHolXr
+wiz0kqRQwivrHN2O613S0Ruis17cvhe0GfMJs+3fCpN8Hu3Wb3d3O1PZ6khjORTy
+Mo9z1LS8fe+6pqKSMPvL24Jp
 -----END PRIVATE KEY-----
diff --git a/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha1 b/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha1
index 253b7580833..dd30990811e 100644
--- a/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha1
+++ b/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha1
@@ -1 +1 @@
-5C24E646664ECD2B45BC3BDAB476A26BAC1FDBBB
\ No newline at end of file
+80AA73D8FFE6C854A357A836C4657D7C03480011
\ No newline at end of file
diff --git a/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha256 b/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha256
index 149747434a2..f209638b231 100644
--- a/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha256
+++ b/jstests/ssl/x509/trusted-client-testdb-roles.pem.digest.sha256
@@ -1 +1 @@
-4091D0B41951A227EE31E13E678299C448ADDAC3AF61DA829FA9BE74BCCBBFD9
\ No newline at end of file
+C02BAD2324CEB0793749AAF4C01CC35B58525BFE00D683B558B4A6E5BF9C2406
\ No newline at end of file
diff --git a/jstests/ssl/x509_custom.js b/jstests/ssl/x509_custom.js
index f4adb576bed..cd90acfcabf 100644
--- a/jstests/ssl/x509_custom.js
+++ b/jstests/ssl/x509_custom.js
@@ -38,9 +38,7 @@ function runTest(conn) {
     const external = conn.getDB('$external');
     external.createUser({user: NAME, roles: [{'role': 'readWrite', 'db': 'test'}]});
 
-    jsTest.log("testClient " + NAME);
     testClient(conn, NAME);
-    jsTest.log("testClient null");
     testClient(conn, null);
 }
 
@@ -48,10 +46,8 @@ function runTest(conn) {
 const mongod = MongoRunner.runMongod({
     auth: '',
     sslMode: 'requireSSL',
-    // Server PEM file is server.pem to match the shell's ca.pem.
     sslPEMKeyFile: SERVER_CERT,
-    // Server CA file is non-expiring-ca.pem to match the shell's client-custom-oids.pem.
-    sslCAFile: 'jstests/libs/non-expiring-ca.pem',
+    sslCAFile: CA_CERT,
     sslAllowInvalidCertificates: '',
 });
 runTest(mongod);