signtool.exe -- blows up with new code signing cert: error -2146885630/0x80092002

I have a working build system, but when we got a new code signing certificate today, signtool stopped working with

SignTool Error: An unexpected internal error has 
occurred. Error information: "Error: 
Store::ImportCertObject() failed." (-2146885630/0x80092002)

How do I resolve?

We figured it out.

Newer code signing certificates have an SHA-256 component. In this case, signtool.exe, which works fine on XP/Server2003 with a pure SHA-1 code signing certificate stops working.

The answer is ... throw away the old build system and move to Win10/Server 2016.