The way CryptAcquireContext is currently used for temporary internal context in CertCreateSelfSignCertificate(), there is always a unique container created and persisted in registry (thus resulting in ever growing registry while an app repeatedly creates ephemeral certs with CertCreateSelfSignCertificate). The unique container name doesn't go anywhere outside of CRYPT_CreateKeyProv, and the crypt context is only used internally in CertCreateSelfSignCertificate() to generate the key and extract the key data (and put that to certificate store), so using a non-persistent context should be better.