PSMDB operator documentation states in https://www.percona.com/doc/kubernetes-operator-for-psmongodb/TLS.html#generate-certificates-manually

You should generate certificates twice: one set is for external communications, and another set is for internal ones. A secret created for the external use must be added to cr.yaml/spec/secretsName. A certificate generated for internal communications must be added to the cr.yaml/spec/sslInternalSecretName.

In reality, the correct specification is different:

cr.yaml