I am developing a CNG Key Store Provider (KSP) that will store keys and certificates remotely in a backend server in order to be used not only on Windows, but also on other OS without the need to export/import several times, every OS will have its own driver.
Currently I am investigating how to let Windows know that my KSP has personal certificates that must be available to other apps using the CryptoAPI, like browsers.
I have read that, when using smartcards, this procedure is done by the "Certificate Propagation Service", that notices when a smartcard is inserted, and then copies the certificates to the "MY" certificate store of current user.
How to do the propagation of certificates available in the KSP? If I call CertAddEncodedCertificateToStore asking to put the certificate in the "MY" store, will it do the trick persisting the certificate for future sessions? If so, I imagine that when some app call CryptAcquireCertificatePrivateKey with that certificate as parameter, the CryptoAPI will ask the KSP for a reference to the private key, right?