MongoDB error: self signed certificate in certificate chain
You have the --sslCAFile pointing at the server.pem file rather than the CA file which seems to be in /etc/mongo/ssl/ca/ca.crt. As a result the cert you have generated for your client connection is not considered valid.

You have a couple of options, you can allow cert-less connections by clients (they are still SSL encrypted, just no cert to validate the client side). This is done by specifying the allowConnectionsWithoutCertificates option on the server and is functionally equivalent to how HTTPS works on the web.

The other option of course is to fix the sslCAFile path to point at the CA cert rather than the server cert.