We are using a client certificate to authenticate with a webservice. This always worked very well using:

var certificateBytes = await File.ReadAllBytesAsync(certificatePath, cancellationToken);
var certificate = new X509Certificate2(certificateBytes, password);

The certificate resides only in a file path and was not installed in any certificate store.

After replacing the .p12 file with a new one (issued by the webservice owner, expiration date extended) we suddenly get an exception at the constructor:

System.Security.Cryptography.CryptographicException: The specified network password is not correct.

This works on my local machine and it also works on our test server. The exception is only thrown in production.