Incase you are implementing witness server as well then it gets a little bit complicated.

Make sure you have created its own certificate on the witness server and on the principal and the mirror server you create user authorization using this witness certificate.

Same thing needs to be done on the witness server as well.You create two user authorization using individual certificates from the principal and the mirror server.