cpverify.exe certName.cer -mk -alg GR3411_2012_256 -inverted_halfbytes 0

public string BuildEsiaAuthPageUri()
{
State = Guid.NewGuid().ToString("D");

var timestamp = DateTime.UtcNow.ToString("yyyy.MM.dd HH:mm:ss +0000");
var scope = RemoveWhitespace(EsiaSettings.Scope);
var msg = $"{EsiaSettings.ClientId}{scope}{timestamp}{State}{EsiaSettings.RedirectUri}";

var clientSecret = Sign(msg);

var builder = new RequestBuilder();
builder.AddParam("client_secret", clientSecret);
builder.AddParam("client_id", EsiaSettings.ClientId);
builder.AddParam("scope", EsiaSettings.Scope);
builder.AddParam("timestamp", timestamp);
builder.AddParam("state", State);
builder.AddParam("redirect_uri", EsiaSettings.RedirectUri);
builder.AddParam("client_certificate_hash", EsiaSettings.ClientCertificateHash);
builder.AddParam("response_type", "code");
builder.AddParam("access_type", "online");

//Вот тут самый важный момент на который было потрачено множество времени. Просто заменяем символы на безопасные
var url = EsiaEndpoints.EsiaAuthTestUrl + "?" + builder.ToString()
.Replace("+", "%2B")
.Replace(":", "%3A")
.Replace(" ", "+");
return url;
}

public string Sign(string msg)
{
var certificate = GetSignerCert();
var signature = SignGOST3411(certificate, Encoding.UTF8.GetBytes(msg));
return Base64UrlEncoder.Encode(signature);
}

private string SignGOST3411(X509Certificate2 certificate, byte[] data)
{
var gost3411 = new Gost3411_2012_256CryptoServiceProvider();
var hashValue = gost3411.ComputeHash(data);
gost3411.Clear();

var signedHash = GostSignHash(hashValue, certificate.PrivateKey as Gost3410_2012_256CryptoServiceProvider, "Gost3411_2012_256");
return Base64UrlEncoder.Encode(signedHash);
}

static byte[] GostSignHash(byte[] HashToSign, Gost3410_2012_256CryptoServiceProvider key, string HashAlg)
{
//Создаем форматтер подписи с закрытым ключом из переданного
//функции криптопровайдера.
Gost2012_256SignatureFormatter Formatter = new Gost2012_256SignatureFormatter(key);

//Устанавливаем хэш-алгоритм.
Formatter.SetHashAlgorithm(HashAlg);

//Создаем подпись для HashValue и возвращаем ее.
return Formatter.CreateSignature(HashToSign);
}