Troubleshoot TLS1.2 in .NET 4.7.2 / 4.8 with wireshark - vb.net

Question

We have problem with .NET application which runs fine on development PC (win10)
but when deployed to "Windows server 2016" production env it reports:
System.Net.WebException: The request was aborted: Could not create
SSL/TLS secure channel.
wireshark difference in Dev and Prod Env
On Dev (Win10) there is "Certificate,Client Key Exchange" after "Server Key Exchange" packet
On Prod (srv 2016) there is "TCP Spurious Retransmission" after "Server Key Exchange" as on screenshot
Tried with .NET 4.7.2 and 4.8 same error, how to proceed ?
It looks like there is problem on production server when PFX cert is used
Dim request As HttpWebRequest = CType(WebRequest.Create("https://obt2b1.service.com/cords/api/"), HttpWebRequest)
request.Method = WebRequestMethods.Http.Post
request.Accept = "application/xml"
request.ContentType = "application/xml"
'Use x509 PFX
request.ClientCertificates.Add(getCert())
request.KeepAlive = True
request.CachePolicy = New System.Net.Cache.RequestCachePolicy(System.Net.Cache.RequestCacheLevel.NoCacheNoStore)
request.Timeout = 1000000
request.AllowAutoRedirect = True
Dim dataStream As Byte() = Encoding.UTF8.GetBytes(xml_send)
request.ContentLength = dataStream.Length
ServicePointManager.Expect100Continue = true
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12
'Here the error "System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel." is reported
Dim _stream As Stream = request.GetRequestStream()
...
Private Function getCert() As X509Certificate2
Dim collection As New X509Certificate2Collection()
collection.Import("C:\pfx\test.pfx", "xxx", X509KeyStorageFlags.PersistKeySet Or X509KeyStorageFlags.UserKeySet Or X509KeyStorageFlags.MachineKeySet Or X509KeyStorageFlags.Exportable)
Return collection(0)
End Function
EDITED ... SecurityProtocol moved up same thing
ServicePointManager.Expect100Continue = true
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12
Dim request As HttpWebRequest = CType(WebRequest.Create("https://obt2b1.service.com/cords/api/"), HttpWebRequest)
request.Method = WebRequestMethods.Http.Post
request.Accept = "application/xml"
request.ContentType = "application/xml"
'Use x509 PFX
request.ClientCertificates.Add(getCert())
request.KeepAlive = True
request.CachePolicy = New System.Net.Cache.RequestCachePolicy(System.Net.Cache.RequestCacheLevel.NoCacheNoStore)
request.Timeout = 1000000
request.AllowAutoRedirect = True
Dim dataStream As Byte() = Encoding.UTF8.GetBytes(xml_send)
request.ContentLength = dataStream.Length
'GetRequestStream() gets the error "System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel." is reported
Dim _stream As Stream = request.GetRequestStream()

Answer 1

OK after an almost week of testing I found a solution.
Things that I tried:
windows server 2012R2 (working no problem)
windows server 2016 (not working)
windows server 2019 (not working)
I tried to enable ALL ciphers and ALL settings in IIS Cryto 3.2 - didn't help.
Problem was in worker process on the IIS, you need to enable "Load User Profile" to True
IIS -> Application Pools -> (choose pool) -> Advanced Settings ...
Change "Load User Profile" from false to true ...
After that I start IIS Crypto 3.2 set all setting to restrictive as it was before