The encryption certificate cannot be accessed by the CRM service account

I'm trying to install CRM 2016 onto a new server, and upgrade an existing CRM 2015 organization in the process.

I'm getting this error during the System Checks step of CRM Setup: "The encryption certificate '(certificate here)' cannot be accessed by the CRM service account."

I have no idea what that means since I see no security settings that I can configure in the Certificates interface.

This is running on Windows Server 2012 R2 with SQL Server 2014 Standard. I took the organization database and the MSCRM_CONFIG database from the old server and restored them onto this server so I could upgrade those databases during this installation. I also installed the certificate from the old server to the certificate store on this new computer.