What should I return from the LocalCerticateSelection callback in sslstream authenticateAsClient? -

i have certificate generated self-signed , had signed vendor. have connect vendor , authenticate using certificate. when authenticateasclient, localcertificateselection callback gets called validissuers parameter being set 1 signed certificate. certificate should returning callback? when return certificate issued vendor error because certificate not sent server. using following code.

namespace testclientauthenticatehttps {     using system;     using system.linq;     using system.net;     using system.net.security;     using system.net.sockets;     using system.security.authentication;     using system.security.cryptography.x509certificates;      class program {         private readonly x509certificate2collection _certs;         private tcpclient _client;         private sslstream _sslstream;         private const string host = "smr-staging.surescripts.net";         private const string ssserial = "40 1f c1 ea 00 00 00 00 02 44";         private const sslprotocols enabledsslprotocols = sslprotocols.ssl3 | sslprotocols.tls | sslprotocols.tls11 | sslprotocols.tls12;          private static void main() {             var program = new program();             program.execute();         }         private program() {             servicepointmanager.securityprotocol = securityprotocoltype.tls12;             var certstore = new x509store(storename.my, storelocation.currentuser);             certstore.open(openflags.openexistingonly | openflags.readonly);             _certs = certstore.certificates.find(x509findtype.findbyserialnumber, ssserial, false);             certstore.close();         }         private void execute() {             connecttohost();             try {                 opensslconnection();                 doauthentication();             } catch (exception e) {                 {                     console.writeline(e.message);                     console.writeline(e.stacktrace);                     e = e.innerexception;                 } while (e != null);             } {                 _sslstream.close();             }             console.readline();         }          private void doauthentication() {             try {                 _sslstream.authenticateasclient(host, _certs, enabledsslprotocols, true);             } catch (exception) {                 console.writeline($"host ({host})");                 console.writeline($"_certs = ");                 _certs.cast<x509certificate>().tolist().foreach(console.writeline);                 throw;             }         }          private void opensslconnection() {             _sslstream = new sslstream(_client.getstream(), false, remotecertificatevalidate,                 localcertificateselection, encryptionpolicy.allownoencryption);         }          private static bool remotecertificatevalidate(object sender, x509certificate certificate, x509chain chain, sslpolicyerrors sslpolicyerrors) {             return true;         }          private static x509certificate localcertificateselection(object sender, string host,             x509certificatecollection localcertificates, x509certificate remotecertificate, string[] acceptableissuers) {             console.writeline($"selecting certificate ({host})");             var acceptable = acceptableissuers.select(s => new x500distinguishedname(s).name?.trim()).where(s => !string.isnullorwhitespace(s)).tolist();             console.writeline("acceptable issuers.");             acceptable.foreach(console.writeline);             console.writeline("local certificate selected");             var result = acceptableissuers.length == 0 ? localcertificates[0] : localcertificates?.cast<x509certificate2>().first(                 c => acceptable.any(n => n.equals(c.issuername.name?.trim(), stringcomparison.invariantcultureignorecase))                 );             console.writeline(result);             return result;         }         private void connecttohost() {             _client = new tcpclient(host, 443);         }     } } 

just make sure certificate returned callback has private key. can setting privatekey property of certificate privatekey property of corresponding self-signed key. if reading ca-issued key certificate store, ensure store opened readwrite instead of readonly.