TLS 1.2 - The token supplied to the function is invalid
<p>I have this strange problem, SslStream.AuthenticateAsClient() throws following exception:</p>

<pre><code>System.Security.Authentication.AuthenticationException : A call to SSPI failed, see inner exception.
  ----&gt; System.ComponentModel.Win32Exception : The token supplied to the function is invalid
</code></pre>

<p>It happens only when Tls12 is required by the client:</p>

<pre><code>SslStream.AuthenticateAsClient(..., ..., SslProtocols.Tls12);
</code></pre>

<p>Code works properly for Ssl3, Tls11 and Tls.</p>

<p>Server certificate is self-signed and 'old'. It uses md5RSA signature and 1024 bits, and innitially I thought that is the problem, as re-generating the certificate makes the exception go away (I tired both SHA1 and SHA512 - both ok).</p>

<p>However, to my surprise FileZilla client is able to connect to this server  using this <strong>'old' md5RSA-signed</strong> cert and using <strong>TLS 1.2</strong>:</p>

<p><a href="https://i.stack.imgur.com/KIeYc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KIeYc.png" alt="TLS 1.2 with old cert"></a></p>

<p>Here is the certificate:</p>

<pre><code>-----BEGIN CERTIFICATE-----
MIICejCCAeOgAwIBAgIQzbvZdHHAV49D7R8OE2mEaDANBgkqhkiG9w0BAQQFADBA
MSswKQYJKoZIhvcNAQkBFhxlbWFpbEBpbi10aGUtY2VydGlmaWNhdGUuY29tMREw
DwYDVQQDEwhKb2huIERvZTAeFw0xMTAxMjAyMDAzNDFaFw0zOTEyMzEyMzU5NTla
MEAxKzApBgkqhkiG9w0BCQEWHGVtYWlsQGluLXRoZS1jZXJ0aWZpY2F0ZS5jb20x
ETAPBgNVBAMTCEpvaG4gRG9lMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0
s5RAKYdw2AYk3t0oH5jDo6RQRRfabkOLfKvR8kOiYbqjtgblx7JhSZJHX/r6KLoc
hGgYkQPOSKnl8TdgEkzPxWHECV/iMdOxTsTv2P//ZM2INjb4H8JjDS16PYFwHP3w
/9RU6PjppK+mPdWP1pezBzebSM0QQwpmXlSmfe2ULQIDAQABo3UwczBxBgNVHQEE
ajBogBA4WNgTvhkmRD8DhHeRvAJcoUIwQDErMCkGCSqGSIb3DQEJARYcZW1haWxA
aW4tdGhlLWNlcnRpZmljYXRlLmNvbTERMA8GA1UEAxMISm9obiBEb2WCEM272XRx
wFePQ+0fDhNphGgwDQYJKoZIhvcNAQEEBQADgYEAFX6MM/E97hC6t1TAFBmM3tWr
fQ2cB0LFCe6J0I8phKQecpSYCkMdvaHdsT+sdzXNW4bgL064r731r8l/47VgfgIR
oRmsQYnwJ55nqZpEW2zL3vioedWiCVto8X9/dVC8jqPpcmMP5NWBHh88o7nkPBxe
C8iucrQvHnjYwaz1o/M=
-----END CERTIFICATE-----
</code></pre>

<p>My questions are: </p>

<ol>
<li><p>Why <code>SslStream.AuthenticateAsClient</code> throws, whereas Filezilla client is able to connect?</p></li>
<li><p>Are there any .NET/Windows 10/CryptoAPI certificate restrictions when TLS 1.2 is used?</p></li>
<li><p>If there are restrictions, why FileZilla is not enforcing them?</p></li>
<li><p>Why so cryptic error message: 'The token supplied to the function is invalid'?</p></li>
</ol>