For those wondering what was (most likely) the actual "solution" - the certificate is generated for a single, specific McMaster-Carr account and you have to use that account credentials in the POST body along with the certificate to be able to log in.