title: TLS 1.2 - The token supplied to the function is invalid
body: <p>I have this strange problem, SslStream.AuthenticateAsClient() throws following exception:</p>
  
  <pre><code>System.Security.Authentication.AuthenticationException : A call to SSPI failed, see inner exception.
    ----&gt; System.ComponentModel.Win32Exception : The token supplied to the function is invalid
  </code></pre>
  
  <p>It happens only when Tls12 is required by the client:</p>
  
  <pre><code>SslStream.AuthenticateAsClient(..., ..., SslProtocols.Tls12);
  </code></pre>
  
  <p>Code works properly for Ssl3, Tls11 and Tls.</p>
  
  <p>Server certificate is self-signed and 'old'. It uses md5RSA signature and 1024 bits, and innitially I thought that is the problem, as re-generating the certificate makes the exception go away (I tired both SHA1 and SHA512 - both ok).</p>
  
  <p>However, to my surprise FileZilla client is able to connect to this server  using this <strong>'old' md5RSA-signed</strong> cert and using <strong>TLS 1.2</strong>:</p>
  
  <p><a href="https://i.stack.imgur.com/KIeYc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KIeYc.png" alt="TLS 1.2 with old cert"></a></p>
  
  <p>Here is the certificate:</p>
  
  <pre><code>-----BEGIN CERTIFICATE-----
  MIICejCCAeOgAwIBAgIQzbvZdHHAV49D7R8OE2mEaDANBgkqhkiG9w0BAQQFADBA
  MSswKQYJKoZIhvcNAQkBFhxlbWFpbEBpbi10aGUtY2VydGlmaWNhdGUuY29tMREw
  DwYDVQQDEwhKb2huIERvZTAeFw0xMTAxMjAyMDAzNDFaFw0zOTEyMzEyMzU5NTla
  MEAxKzApBgkqhkiG9w0BCQEWHGVtYWlsQGluLXRoZS1jZXJ0aWZpY2F0ZS5jb20x
  ETAPBgNVBAMTCEpvaG4gRG9lMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0
  s5RAKYdw2AYk3t0oH5jDo6RQRRfabkOLfKvR8kOiYbqjtgblx7JhSZJHX/r6KLoc
  hGgYkQPOSKnl8TdgEkzPxWHECV/iMdOxTsTv2P//ZM2INjb4H8JjDS16PYFwHP3w
  /9RU6PjppK+mPdWP1pezBzebSM0QQwpmXlSmfe2ULQIDAQABo3UwczBxBgNVHQEE
  ajBogBA4WNgTvhkmRD8DhHeRvAJcoUIwQDErMCkGCSqGSIb3DQEJARYcZW1haWxA
  aW4tdGhlLWNlcnRpZmljYXRlLmNvbTERMA8GA1UEAxMISm9obiBEb2WCEM272XRx
  wFePQ+0fDhNphGgwDQYJKoZIhvcNAQEEBQADgYEAFX6MM/E97hC6t1TAFBmM3tWr
  fQ2cB0LFCe6J0I8phKQecpSYCkMdvaHdsT+sdzXNW4bgL064r731r8l/47VgfgIR
  oRmsQYnwJ55nqZpEW2zL3vioedWiCVto8X9/dVC8jqPpcmMP5NWBHh88o7nkPBxe
  C8iucrQvHnjYwaz1o/M=
  -----END CERTIFICATE-----
  </code></pre>
  
  <p>My questions are: </p>
  
  <ol>
  <li><p>Why <code>SslStream.AuthenticateAsClient</code> throws, whereas Filezilla client is able to connect?</p></li>
  <li><p>Are there any .NET/Windows 10/CryptoAPI certificate restrictions when TLS 1.2 is used?</p></li>
  <li><p>If there are restrictions, why FileZilla is not enforcing them?</p></li>
  <li><p>Why so cryptic error message: 'The token supplied to the function is invalid'?</p></li>
  </ol>