gistfile1.txt

The following rules apply for both the Admin client and the Node certs:

If the Public Certifcate contains the X509v3 extensions section, it must have both Client and Server Authentication:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
Alternatively, if the Public Certificate does not even have the X509v3 extensions section this is also acceptable and known to work.