提供给包的凭证未被识别.使用BouncyCastle生成的证书对服务器进行身份验证时出现错误

我正在尝试使用BouncyCastle创建证书。Crypto dll，然后用于将SslStream作为Windows服务进程中的服务器进行身份验证，该进程在本地系统帐户下运行。

然而，当我得到SslStream.AuthenticateAsServer(证书)调用时，它抛出一个Win32异常，错误消息为"提供给包的凭据未被识别"。

这里有几个关于这个错误信息的问题，但它们似乎没有一个描述或解决我的特定问题。

希望有人能提供一些帮助，我包含了我用来创建和安装证书的代码:

// First create a certificate using the BouncyCastle classes
BigInteger serialNumber = BigInteger.ProbablePrime(120, new Random());
AsymmetricCipherKeyPair keyPair = GenerateKeyPair();
X509V1CertificateGenerator generator = new X509V1CertificateGenerator();
generator.SetSerialNumber(serialNumber);
generator.SetIssuerDN(new X509Name("CN=My Issuer"));
generator.SetNotBefore(DateTime.Today);
generator.SetNotAfter(DateTime.Today.AddYears(100));
generator.SetSubjectDN(new X509Name("CN=My Issuer"));
generator.SetPublicKey(keyPair.Public);
generator.SetSignatureAlgorithm("SHA1WITHRSA");
Org.BouncyCastle.X509.X509Certificate cert = generator.Generate(
    keyPair.Private, SecureRandom.GetInstance("SHA1PRNG"));
// Ok, now we have a BouncyCastle certificate, we need to convert it to the 
// System.Security.Cryptography class, by writing it out to disk and reloading
X509Certificate2 dotNetCert;
string tempStorePassword = "Password01"; // In real life I'd use a random password
FileInfo tempStoreFile = new FileInfo(Path.GetTempFileName());
try
{
    Pkcs12Store newStore = new Pkcs12Store();
    X509CertificateEntry entry = new X509CertificateEntry(cert);
    newStore.SetCertificateEntry(Environment.MachineName, entry);
    newStore.SetKeyEntry(
        Environment.MachineName,
        new AsymmetricKeyEntry(keyPair.Private),
        new [] { entry });
    using (FileStream s = tempStoreFile.Create())
    {
        newStore.Save(s, 
            tempStorePassword.ToCharArray(), 
            new SecureRandom(new CryptoApiRandomGenerator()));
    }
    // Reload the certificate from disk
    dotNetCert = new X509Certificate2(tempStoreFile.FullName, tempStorePassword);
}
finally
{
    tempStoreFile.Delete();
}
// Now install it into the required certificate stores
X509Store targetStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
targetStore.Open(OpenFlags.ReadWrite);
targetStore.Add(dotNetCert);
targetStore.Close();

Ok，现在我已经创建并安装了证书。然后，我通过提供生成的证书的指纹来配置我的Windows服务以使用此证书。然后我像这样使用证书:

// First load the certificate
X509Certificate2 certificate = null;
X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
foreach (X509Certificate2 certInStore in store.Certificates)
{
    if (certInStore.Thumbprint == "...value not shown...")
    {
        certificate = certInStore;
        break;
    }
}
SslStream sslStream = new SslStream(new NetworkStream(socket, false), false);
// Now this line throws a Win32Exception 
// "The credentials supplied to the package were not recognized"
sslStream.AuthenticateAsServer(certificate);

有人知道这里可能有什么问题吗?

如果我安装一个用'makecert'创建的证书，我不会得到这个问题，但这不适用于生产证书。

我还尝试创建一个单独的x509v1 CA证书，然后创建x509v3证书用于服务器身份验证，但我得到了相同的错误，因此为了简单起见，我在示例代码中删除了此错误。

Org.BouncyCastle.X509.X509Certificate bcCert;
X509Certificate dotNetCert = DotNetUtilities.ToX509Certificate(bcCert);
X509Certificate2 dotNetCert2 = new X509Certificate2(dotNetCert);

// Apparently, using DotNetUtilities to convert the private key is a little iffy. Have to do some init up front.
RSACryptoServiceProvider tempRcsp = (RSACryptoServiceProvider)DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters)ackp.Private);
RSACryptoServiceProvider rcsp = new RSACryptoServiceProvider(new CspParameters(1, "Microsoft Strong Cryptographic Provider", 
            new Guid().ToString(), 
            new CryptoKeySecurity(), null));
rcsp.ImportCspBlob(tempRcsp.ExportCspBlob(true));
dotNetCert2.PrivateKey = rcsp;

"C:'Program Files (x86)'Windows Resource Kits'Tools'winhttpcertcfg" -i cert.p12 -c LOCAL_MACHINE'My -a UserWhoUsesTheCert -p passwordforp12