title: HttpClient refusing to send self-signed client certificate
body: <p>I am attempting to <strong>send</strong> a self-signed <strong>client certificate</strong> using <code>HttpClient</code> with the following code:</p>
  <pre><code>var handler = new HttpClientHandler();
  handler.ClientCertificateOptions = ClientCertificateOption.Manual; 
  handler.ClientCertificates.Add(GetClientCertificate()); //Loads cert from a .pfx file
  var client = new HttpClient(handler);
  PerformRequest(client);
  </code></pre>
  <p>I've seen a dozen SO posts related to this, but none have resolved my issue.</p>
  <p>Things to note:</p>
  <ul>
  <li>I have verified via Wireshark that the server is requesting a client cert, but <code>HttpClient</code> is not sending one.</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/Vxlru.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Vxlru.png" alt="When sent via HttpClient" /></a></p>
  <ul>
  <li>The exact same certificate (same .pfx file is used) is sent when I use Postman to perform the request</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/nsMuW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/nsMuW.png" alt="When sent via Postman" /></a></p>
  <ul>
  <li>I have tried forcing the TLS version via <code>handler.SslProtocols</code> to 1.0, 1.1, 1.2 -- none work</li>
  <li>The <code>X509Certificate2</code> returned from <code>GetClientCertificate()</code> has a private key</li>
  <li>This is on .NET Framework 4.7.2 -- I can't change this</li>
  </ul>
  <p>I have been troubleshooting this for 3 days now and even read through the reference source trying to figure out why my cert isn't included, but I can't find a reason.<br />
  I suspect somewhere deep inside the <code>HttpClient</code> implementation, my cert is getting rejected because it is self-signed.</p>
  <p>How can I force it to send my cert? (the server maintains a whitelist, so I don't care if it thinks my cert is invalid).
  Or, at bare minimum, how can I get any sort of debugging information out of this?  Is there any way to get a reason why a cert is rejected?</p>
  <hr />
  <p>Update:</p>
  <p>After enabling tracing, I have found that .NET is correctly selecting my certificate:</p>
  <pre><code>System.Net Information: 0 : [23960] SecureChannel#64538993 - Selected certificate: &lt;omitted&gt;
  System.Net Information: 0 : [23960] SecureChannel#64538993 - Left with 1 client certificates to choose from.
  System.Net Information: 0 : [23960] SecureChannel#64538993 - Trying to find a matching certificate in the certificate store.
  System.Net Information: 0 : [23960] SecureChannel#64538993 - Locating the private key for the certificate: &lt;omitted&gt;
  System.Net Information: 0 : [23960] SecureChannel#64538993 - Certificate is of type X509Certificate2 and contains the private key.
  System.Net Information: 0 : [23960] SecureChannel#64538993::.AcquireClientCredentials, new SecureCredential() (flags=(ValidateManual, NoDefaultCred, SendAuxRecord), m_ProtocolFlags=(Tls12Client), m_EncryptionPolicy=RequireEncryption)
  System.Net Information: 0 : [23960] AcquireCredentialsHandle(package = Microsoft Unified Security Protocol Provider, intent  = Outbound, scc     = System.Net.SecureCredential)
  System.Net Information: 0 : [23960] InitializeSecurityContext(credential = System.Net.SafeFreeCredential_SECURITY, context = 21c5cd98:21cd2108, targetName = &lt;omitted&gt;, inFlags = ReplayDetect, SequenceDetect, Confidentiality, AllocateMemory, InitManualCredValidation)
  System.Net Information: 0 : [23960] InitializeSecurityContext(In-Buffers count=2, Out-Buffer length=100, returned code=ContinueNeeded).
  ... etc
  </code></pre>
  <p>However, it is still not being sent.  Any more ideas on where to look would be greatly appreciated.</p>