Hans Leidekker (@hans) commented about dlls/crypt32/pfx.c:
DWORD size, acquire_flags; void *key; struct import_store_key_params params = { data, NULL, &size }; - - if (CRYPT32_CALL( import_store_key, ¶ms ) != STATUS_BUFFER_TOO_SMALL) return 0; + /* Use a unique container name per import. With a NULL container + + * CRYPT_NEWKEYSET the CSP falls back to its per-user default container + * ("<USERNAME>"), so a second PFX import overwrites the first import's + * private key inside that shared container; any cert from the first + * import still held will then find the second import's key when its + * CRYPT_KEY_PROV_INFO is followed back to the container. Follow the + * same UuidCreate-via-rpcrt4 pattern that CRYPT_CreateKeyProv + * (cert.c) uses for the same problem on the synthesise-a-key path. */ + HMODULE rpcrt = LoadLibraryW( L"rpcrt4" );
It would be better to add rpcrt4 to DELAYIMPORTS in the makefile and create a helper shared by CRYPT_CreateKeyProv() and this function. Please use wide character functions. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/11268#note_144424