http://bugs.winehq.org/show_bug.cgi?id=27168
--- Comment #22 from Juan Lang juan_lang@yahoo.com 2011-09-14 14:41:10 CDT --- (In reply to comment #21)
If nonexistent, searches for the szOID_SUBJECT_KEY_IDENTIFIER extension. If that fails, a SHA1 hash is done on the certificate's SubjectPublicKeyInfo member to produce the identifier values. (http://msdn.microsoft.com/en-us/library/aa376079(v=vs.85).aspx)
MSDN is frequently wrong, and I think it is in this case, as the existing test case I pointed you too demonstrates.