Since the introduction of xConnect there have been hundreds (if not thousands) of articles, posts and blogs covering the who/what/when/where and wtf? is wrong with xConnect.
Many of these articles focus on xConnect setup or issues with the application accessing the certificates from a given certificate store. A less known or documented issue is the 'Invalid certificate' error which can be caused by incorrect IIS client certificate settings on the xConnect services.
ERROR Cannot start analytics Tracker Exception: System.InvalidOperationException Message: Ensure definition type did not complete successfully. StatusCode: 401, ReasonPhrase: 'Invalid certificate'
The resolution is simple, update the SSL Settings for a given site to "Accept" or "Require" client certificates.