Should the following line be true or false when issuing a cert instead of creating a CA cert?

const bool isCertificateAuthority = true; // or false?

https://github.com/rlipscombe/bouncy-castle-csharp/blob/master/CreateCertificate/Program.cs#L109

Thank you for your excellent repository. I searched far and wide for a simple Bouncy Castle implementation that just works, and this is it.

However, I'm running into a problem after updating the code to the current API.

As you likely know, the certificate generator's SetSignatureAlgorithm() method has been deprecated since you wrote your code. So I swapped in the new ISignatureFactory syntax, like so:

ISignatureFactory signatureFactory = new Asn1SignatureFactory(PkcsObjectIdentifiers.Sha256WithRsaEncryption.ToString(), subjectKeyPair.Private, random);
var certificate = certificateGenerator.Generate(signatureFactory);

Note that this works just fine when creating the Root CA. Oddly, however, it fails when attempting to issue a new certificate signed by that CA:

When we revert back to the original (deprecated) code, everything goes through as expected.

What do you make of it?