How to resolve ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY for self hosted signalR?

I'm trying to host a SignalR hub in a .NET Core 3.1 Windows Service, and when my client begins negotiation it fails with the response net::ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY

My SSL certificate is successfully loaded, and it checks out as valid in browser on port 443, but when browsing to my alternate port (randomly selected 12457) the browser does not consider it valid

If I switch down to HTTP1, I get a 405 I suspect from incompatibility with the client (microsoft/angular).

Here's how I'm configuring with my SSL certificate

.ConfigureWebHostDefaults(webBuilder =>
{
  webBuilder.UseStartup<Startup>();
  webBuilder.UseUrls(configuration.GetValue<string>("ListenerEndpoint"));
  webBuilder.UseKestrel(options =>
  {
    options.Listen(IPAddress.Any, 12457, listenOptions =>
    {
      listenOptions.UseHttps(options =>
      {
        var certificateStore = new X509Store(StoreName.Root, StoreLocation.LocalMachine, OpenFlags.ReadOnly);

        var certificates = certificateStore.Certificates.Find(X509FindType.FindByThumbprint, "<thumbprint>", true);

        var certificate = certificates[0];

        options.ServerCertificate = certificate;
      });
    });
  });
});

I've followed the netsh command to expose the cert on this port per: https://weblog.west-wind.com/posts/2013/Sep/23/Hosting-SignalR-under-SSLhttps#:~:text=Even%20if%20your%20self-hosted%20SignalR%20application%20doesn%27t%20explicitly,that%20will%20reject%20mixed%20content%20on%20SSL%20pages. without a positive effect