It looks like these added certs are still using RC2 for encryption, which is not supported on Android. We need these .noRC2 files versions to not use RC2 encryption. Dumping info for one of the added certs under TestDataCertificates:

>  openssl pkcs12 -in ./TestDataCertificates/testclienteku.contoso.com.noRC2.pfx -info                      
...
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048

The .noRC2 versions of all the certs were created in order to avoid using RC2 (they use TripleDES instead). Dumping info for one of the certs under TestData:

> openssl pkcs12 -in ./TestData/testclienteku.contoso.com.noRC2.pfx -info 
...
PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2000

I added new commit,
the info is:

PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

I just realized that the versions of testselfsignedclienteku.contoso.com.pfx and testselfsignedservereku.contoso.com.pfx under the TestDataCertificates folder are also using RC2 now. The existing versions in the TestData folder were already only using TripleDES instead of RC2, which is why we didn't have to add noRC2 versions originally. Could you create noRC2 versions of those too? Sorry, I know this is obnoxious.

I'm wondering if we should make the noRC2 simply the default rather than creating separate files.
I had similar problem as some super new versions of openssl (maybe in combination with distro) disable very old ciphers - like rc2 so we may see more failures going forward.

cc @bartonjs for thoughts on noRC2/RC2 as the default for cert test data
I'd guess we'd hit the same problems / go with the same default for X509Certificates.TestData

thoughts on noRC2/RC2 as the default for cert test data

We probably want to keep some in X509Certificates, since that's how Windows XP generated PFXes (and everyone else copied that behavior), but outside X509 it's not important... they can all be 3DES so long as they open everywhere.

I'll remove all *.noRC2.pfx and replace *.pfx with triple des.

@elinor-fung can you please verify the current version fulfil your requirements?