Replicating specific certificate cURL with dotnetcore HttpClient

Question

I'm trying to replicate a curl command in dotnetcore to connect to a kubernetes cluster (from within).

The following curl command works. curl -v --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes/

This is my attempt to recreate this using HttpClient

private HttpClient GetClient()
{
    const string certPath = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt";
    const string tokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token";
    const string baseAddress = "https://kubernetes";
    var handler = new HttpClientHandler
    {
        ClientCertificateOptions = ClientCertificateOption.Manual,
        SslProtocols = SslProtocols.Tls12
    };
    handler.ClientCertificates.Add(
       new X509Certificate2(certPath));

    var token = File.ReadAllText(tokenPath);
    var httpClient = new HttpClient(handler)
    {
        BaseAddress = baseAddress,
        DefaultRequestHeaders =
        {
            {"Authorization", $"Bearer {token}"}
        }
    };
    return httpClient;
}

public void Test()
{
    var client = GetClient();
    var result = client.GetStringAsync("/").GetAwaiter().GetResult();
    Console.WriteLine(result);
}

The exception isn't all too helpful, and I'm not really sure where I'm misconfiguring my HttpClient.

Here's the exception details

System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.CurlException: SSL connect error
   at System.Net.Http.CurlHandler.ThrowIfCURLEError(CURLcode error)
   at System.Net.Http.CurlHandler.MultiAgent.FinishRequest(StrongToWeakReference`1 easyWrapper, CURLcode messageResult)
   --- End of inner exception stack trace ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at System.Net.Http.HttpClient.<FinishSendAsync>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at System.Net.Http.HttpClient.<GetContentAsync>d__32`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

Any pointers appreciated.