I got some hints that the problem could be SP2 not supporting certs of a certain bit size. Good that upgrading helped.