title: Adding a CA certificate for client certificates
body: <p>I'm writing a server application that uses CryptoAPI and Schannel for setting up a secure SSL connection to clients. The server requires the clients to submit a certificate for verification (by setting the <code>ASC_REQ_MUTUAL_AUTH</code> flag in <code>AcceptSecurityContext</code>).</p>
  
  <p>The problem I have is that some clients (namely clients using <code>javax.net.ssl</code>) does not pass along their client certificate (even though it's been configured to do so). I suspect this is because the CA certificate used for signing the client certificates are not in the list of CA's passed to the client during the handshake.</p>
  
  <p>I've tried to do variations of the following to add the CA certificate to this list:</p>
  
  <pre class="lang-cpp prettyprint-override"><code>PCERT_CONTEXT caCertContext = ...; /* Imported from a DER formatted file */
  
  HCERTSTORE systemStore = CertOpenStore(
                  CERT_STORE_PROV_SYSTEM,
                  0,
                  0,
                  CERT_STORE_OPEN_EXISTING_FLAG |
                      CERT_SYSTEM_STORE_LOCAL_MACHINE,
                  L"ROOT");
  
  bool ok = CertAddCertificateContextToStore(
                  systemStore,
                  caCertContext,
                  CERT_STORE_ADD_USE_EXISTING,
                  NULL);
  
  if (!ok)
  {
      std::cerr &lt;&lt; "Could not add certificate to system store!" &lt;&lt; std::endl;
  }
  </code></pre>
  
  <p>In the above example <code>CertAddCertificateContextToStore</code>always fails. If I change <code>CERT_SYSTEM_STORE_LOCAL_MACHINE</code>to <code>CERT_SYSTEM_STORE_CURRENT_USER</code> I am presented with a popup asking me to confirm the certificate, but even if I accept the CA certificate will not appear in the list sent to the client.</p>
  
  <p>I also tried extending the system store collection with a temporary memory store (something I picked up from <a href="https://stackoverflow.com/questions/1557710/winhttp-how-to-use-a-temporary-certificate-store">here</a>) but to no avail.</p>
  
  <p>Anyone know of a way to solve this? Ideally programmatically without using any GUI or external tool?</p>