I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when a website requires the certificate for mutual authentication the browser (Chrome, Firefox, Edge) does not show the certificate for selection.
First I thought it could be an issue with the key usage, but if I request a certificate for the same certificate template to store it on a smart-card it is shown by the browser (The smart-card uses the standard providers).
So I think it has something to to with my key storage provider, but I cannot figure out what is wrong nor do I have a clue how to track the problem down.
Some sources in the web say that CNG is not supported for mutual authentication but they are quite old and the mentioned solution states the opposite so I am quite unsure if what I am trying to achieve is possible at all.
Adding the code for propagation (perhaps the culprit for the behaviour):
CRYPT_KEY_PROV_INFO newProvInfo; newProvInfo.pwszProvName = KEY_PROVIDER_NAME; newProvInfo.dwProvType = 0; SHStrDupW(keyName, &newProvInfo.pwszContainerName); newProvInfo.dwKeySpec = AT_SIGNATURE; newProvInfo.dwFlags = 0; newProvInfo.cProvParam = 0; newProvInfo.rgProvParam = nullptr; CertSetCertificateContextProperty(pcCertContext, CERT_KEY_PROV_INFO_PROP_ID, 0, &newProvInfo); CertAddCertificateContextToStore(certStoreHandle, pcCertContext, CERT_STORE_ADD_REPLACE_EXISTING, nullptr)
Finally I got the certificate propagated in a way that it is displayed by Chrome and IE (It seems it was a certificate tempalte issue). Furthermore
certutil -verifystore tells me that the signature was successful and the certificate is valid. When I use certutil my KSP is called and able to do the signing operation.
However, when I select the certificate for authentication in the browser the authentication fails with HTTP 403. Looking in my KSP logs I see that it is not called. Is there anything else I have to do when registering my KSP or the certificate in order to get this to work?