How to set a temporary truststore for WinHttp ?

[Emil]

Hi all,

we use WinHttp with SSL enabled for secure client/server connections. We
have a private PKI and need to import our CA certificate into an appropriate
truststore, so the SSL handshake runs through. Preparing a truststore outside
the application is no option. We started with temporarily importing the CA
certificate into the system certstore, but of course this fails for users
without admin rights. We didn't like this approach, because it side effects
all other applications accessing the system truststore, but saw no other
choice to achieve our goal.

My questions are:
- can we create a temporary truststore and tell WinHttp to use this
truststore for the SSL handshake?
- if not, what other choice do we have?

Thanks for your help,
Emil

[Stephen Sulzer]

Hello Emil,

Are you referring to loading a certificate to be used for SSL client
authentication?

You can create an in-memory temporary certificate store by calling
CertOpenStore with CERT_STORE_PROV_MEMORY. I think you can then import a
certificate file into that store using CryptUIWizImport (which can be done
without displaying any UI). Then use CertFindCertificateInStore to acquire a
CERT_CONTEXT pointer, which can be given to WinHttp (via WinHttpSetOption
WINHTTP_OPTION_CLIENT_CERT_CONTEXT).

Hope that helps.

Regards,
Stephen