SignalR HubConnection.Start() succeeds but Invoke() fails with authentication error - signalr

Question

I have a SignalR application that has both Web and .NET clients. The website uses windows authentication:
<authentication mode="Windows" />
<authorization>
<deny users="?" />
</authorization>
It works perfectly from the web client, and the .NET client if I create the credentials manually:
hubConnection.Credentials = new NetworkCredential(username, password);
but I have problems if I use CredentialCache.DefaultCredentials. The HubConnection.Start() succeeds, but a later call to hubProxy.Invoke() fails with an authentication error:
HttpClientException
StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
Server: Microsoft-IIS/8.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Tue, 09 Jun 2015 09:07:11 GMT
Content-Length: 1293
Content-Type: text/html
}
The strange thing is that the .NET client receives requests that were registered with the hubProxy.On<>() method, even though it can't send requests!
Edit
So, here is a little more information.
As well as working when the credentials are supplied as a NetworkCredential object, it also appears to work when running in a remote session on our Window 2012 server. Here is what the failed log looks like:
10:28:32.9467758 - null - ChangeState(Disconnected, Connecting)
10:28:33.4358247 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - SSE: GET https://server/signalr/connect?clientProtocol=1.4&transport=serverSentEvents&connectionData=[{"Name":"NotificationHub"}]&connectionToken=kgusKft%2FzqjiJ%2BlIJL8G9CRmNlDNP5SHSNrFHSPEMkKR1xJNwCa6bMvX%2FoFcxVQzeZ22%2B8pUUDzWMHnpDZEdtNSItYxx4qoH17yDKG20vRnCCM5EYqIi%2BANJSwPwyp8gtgquQ40NSWK%2B4xh7wj8g%3D%3D
10:28:33.4538265 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - SSE: OnMessage(Data: initialized)
10:28:33.4538265 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - SSE: OnMessage(Data: {"C":"d-D46072F5-B,5|y,0|T,0|z,1","S":1,"M":[]})
10:28:33.5108322 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - SSE: OnMessage(Data: {"C":"d-D46072F5- B,5|y,0|T,0|z,2|V,0","G":"0Va/0XgwDTaQJuNkmh+foUAw65Q/VPLZi0zjJjns6qoqwTlKzNqna6IlVZlLZmihC2in5/fr+jzG7G5SNoDbRwDvLb31tD6GiLRv3OqYVjIY6uKpjRgyel86eBlQBuXGpeQcGDONymjnpsSF0GyGZrnEaKDa3Ph84x67Am6PU=","M":[]})
10:28:33.5178329 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - ChangeState(Connecting, Connected)
10:28:41.6636474 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - SSE: OnMessage(Data: {})
10:28:51.0955881 - 28f8fa9a-cdb9-4b55-8442-343bdbc6bd11 - Exception thrown by Task: System.AggregateException: One or more errors occurred. ---> Microsoft.AspNet.SignalR.Client.HttpClientException: StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
Server: Microsoft-IIS/8.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Thu, 11 Jun 2015 10:28:51 GMT
Content-Length: 1293
Content-Type: text/html
}
And here is the log from a successful attempt:
08:48:10.4054328 - null - ChangeState(Disconnected, Connecting)
08:48:11.6989325 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: GET https://server/signalr/connect?clientProtocol=1.4&transport=serverSentEvents&connectionData=[{"Name":"NotificationHub"}]&connectionToken=PY5qkPBIdZJ2%2FHIpDoMz7%2BM6njFH7Ky%2BfAa4NPf9TuZc0Rptpo%2BZfhQddF3rONtbmVB6N3fCjnigAJa5e7TBAYqADqwzSwTsQBL8SKE66Ffp9U4tHgGp%2B22e1ml6voPYEbIsMtaP60oTI0dn6AAEYFtTmjo%2FFTwQmWXdUhS4%3D
08:48:12.0891098 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: initialized)
08:48:12.1051173 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {"C":"d-AE2CE5E6-B,8|Bw,0|Bl,0|Bx,1","S":1,"M":[]})
08:48:12.6012242 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {"C":"d-AE2CE5E6-B,8|Bw,0|Bl,0|Bx,2|Bn,0","G":"9uGkt7Ji5H7e9BqgYRvssYqHcUqaB2f/QZWW3HDkaO6s+uDE1+49KkzNWmjyP4RSkd7GRhaEa3uQ68J0v488gxGjqJMyeHrui21kFDLLl4AFITvFrTJMa92pSAUkjq0ZF4qVfG51UDJ6TT2O9p6ZmOe7HVtZXMLWwyASVq6VFV4=","M":[]})
08:48:12.6282349 - 62345d8c-fdae-4fec-baa1-19125f908120 - ChangeState(Connecting, Connected)
08:48:18.9582313 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {})
08:48:28.9796826 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {})
08:48:34.5974895 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {"C":"d-AE2CE5E6-B,8|Bw,1|Bl,0|Bx,2|Bn,0","M":[{"H":"NotificationHub","M":"Hello","A":[]}]})
08:48:34.5994973 - 62345d8c-fdae-4fec-baa1-19125f908120 - OnMessage({"I":"0"})
08:48:38.9895450 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {})
08:48:49.0992213 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {})
08:48:59.1190704 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {})
The point at which the error occurs is the call to Hello:
08:48:34.5974895 - 62345d8c-fdae-4fec-baa1-19125f908120 - SSE: OnMessage(Data: {"C":"d-AE2CE5E6-B,8|Bw,1|Bl,0|Bx,2|Bn,0","M":[{"H":"NotificationHub","M":"Hello","A":[]}]})
Edit 2
A bit more information - I only have the problem when using https. I now have my windows clients connecting over http and everything is fine. I would like to move back to https, but fortunately it is not essential for this project.