9 files changed, 184 insertions, 202 deletions
diff --git a/Swiften/TLS/CAPICertificate.cpp b/Swiften/TLS/CAPICertificate.cpp
new file mode 100644
index 0000000..9a3bbc8
--- /dev/null
+++ b/Swiften/TLS/CAPICertificate.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2012 Isode Limited, London, England.
+ * Licensed under the simplified BSD license.
+ * See Documentation/Licenses/BSD-simplified.txt for more information.
+ */
+#pragma once
+
+#include <Swiften/TLS/CAPICertificate.h>
+
+#include <boost/algorithm/string/predicate.hpp>
+
+
+namespace Swift {
+CAPICertificate::CAPICertificate(const std::string& capiUri)
+			  		 : valid_(false), uri_(capiUri), certStoreHandle_(0), certStore_(), certName_() {
+	setUri(capiUri);
+}
+
+CAPICertificate::~CAPICertificate() {
+	if (certStoreHandle_) {
+		CertCloseStore(certStoreHandle_, 0);
+	}
+}
+
+bool CAPICertificate::isNull() const {
+	return uri_.empty() || !valid_;
+}
+
+const std::string& CAPICertificate::getCertStoreName() const {
+	return certStore_;
+}
+
+const std::string& CAPICertificate::getCertName() const {
+	return certName_;
+}
+
+void CAPICertificate::setUri (const std::string& capiUri) {
+
+	valid_ = false;
+
+	/* Syntax: "certstore:" [<cert_store> ":"] <cert_id> */
+
+	if (!boost::iequals(capiUri.substr(0, 10), "certstore:")) {
+		return;
+	}
+
+	/* Substring of subject: uses "storename" */
+	std::string capi_identity = capiUri.substr(10);
+	std::string new_certStore_name;
+	size_t pos = capi_identity.find_first_of (':');
+
+	if (pos == std::string::npos) {
+		/* Using the default certificate store */
+		new_certStore_name = "MY";
+		certName_ = capi_identity;
+	}
+	else {
+		new_certStore_name = capi_identity.substr(0, pos);
+		certName_ = capi_identity.substr(pos + 1);
+	}
+
+	PCCERT_CONTEXT pCertContext = NULL;
+
+	if (certStoreHandle_ != NULL) {
+		if (new_certStore_name != certStore_) {
+			CertCloseStore(certStoreHandle_, 0);
+			certStoreHandle_ = NULL;
+		}
+	}
+
+	if (certStoreHandle_ == NULL) {
+		certStoreHandle_ = CertOpenSystemStore(0, certStore_.c_str());
+		if (!certStoreHandle_) {
+			return;
+		}
+	}
+
+	certStore_ = new_certStore_name;
+
+	/* NB: This might have to change, depending on how we locate certificates */
+
+	// Find client certificate. Note that this sample just searches for a
+	// certificate that contains the user name somewhere in the subject name.
+	pCertContext = CertFindCertificateInStore(certStoreHandle_,
+			X509_ASN_ENCODING,
+			0,				// dwFindFlags
+			CERT_FIND_SUBJECT_STR_A,
+			certName_.c_str(),		// *pvFindPara
+			NULL );				// pPrevCertContext
+
+	if (!pCertContext) {
+		return;
+	}
+
+
+	/* Now verify that we can have access to the corresponding private key */
+
+	DWORD len;
+	CRYPT_KEY_PROV_INFO *pinfo;
+	HCRYPTPROV hprov;
+	HCRYPTKEY key;
+
+	if (!CertGetCertificateContextProperty(pCertContext,
+			CERT_KEY_PROV_INFO_PROP_ID,
+			NULL,
+			&len)) {
+		CertFreeCertificateContext(pCertContext);
+		return;
+	}
+
+	pinfo = static_cast<CRYPT_KEY_PROV_INFO *>(malloc(len));
+	if (!pinfo) {
+		CertFreeCertificateContext(pCertContext);
+		return;
+	}
+
+	if (!CertGetCertificateContextProperty(pCertContext,
+			CERT_KEY_PROV_INFO_PROP_ID,
+			pinfo,
+			&len)) {
+		CertFreeCertificateContext(pCertContext);
+		free(pinfo);
+		return;
+	}
+
+	CertFreeCertificateContext(pCertContext);
+
+	// Now verify if we have access to the private key
+	if (!CryptAcquireContextW(&hprov,
+			pinfo->pwszContainerName,
+			pinfo->pwszProvName,
+			pinfo->dwProvType,
+			0)) {
+		free(pinfo);
+		return;
+	}
+
+	if (!CryptGetUserKey(hprov, pinfo->dwKeySpec, &key)) {
+		CryptReleaseContext(hprov, 0);
+		free(pinfo);
+		return;
+	}
+
+	CryptDestroyKey(key);
+	CryptReleaseContext(hprov, 0);
+	free(pinfo);
+
+	valid_ = true;
+}
+
+}
diff --git a/Swiften/TLS/CAPICertificate.h b/Swiften/TLS/CAPICertificate.h
index fcdb4c2..d9e2704 100644
--- a/Swiften/TLS/CAPICertificate.h
+++ b/Swiften/TLS/CAPICertificate.h
@@ -1,196 +1,42 @@
 /*
  * Copyright (c) 2012 Isode Limited, London, England.
  * Licensed under the simplified BSD license.
  * See Documentation/Licenses/BSD-simplified.txt for more information.
  */
 
 #pragma once
 
 #include <Swiften/Base/SafeByteArray.h>
 #include <Swiften/TLS/CertificateWithKey.h>
 
-#include <boost/algorithm/string/predicate.hpp>
-
 #define SECURITY_WIN32
+#include <Windows.h>
 #include <WinCrypt.h>
 
 namespace Swift {
 	class CAPICertificate : public Swift::CertificateWithKey {
 		public:
-			CAPICertificate(const std::string& capiUri)
-			    : valid_(false), uri_(capiUri), cert_store_handle_(0), cert_store_(NULL), cert_name_(NULL) {
-				setUri(capiUri);
-			}
-
-			virtual ~CAPICertificate() {
-				if (cert_store_handle_ != NULL)
-				{
-					CertCloseStore(cert_store_handle_, 0);
-				}
-			}
-
-			virtual bool isNull() const {
-				return uri_.empty() || !valid_;
-			}
-
-			virtual bool isPrivateKeyExportable() const {
-				/* We can check with CAPI, but for now the answer is "no" */
-				return false;
-			}
-
-			virtual const std::string& getCertStoreName() const {
-			    return cert_store_;
-			}
-
-			virtual const std::string& getCertName() const {
-			    return cert_name_;
-			}
-
-			const ByteArray& getData() const {
-////Might need to throw an exception here, or really generate PKCS12 blob from CAPI data?
-				assert(0);
-			}
-
-			void setData(const ByteArray& data) {
-				assert(0);
-			}
-
-			const SafeByteArray& getPassword() const {
-/////Can't pass NULL to createSafeByteArray!
-/////Should this throw an exception instead?
-				return createSafeByteArray("");
-			}
-
-		protected:
-			void setUri (const std::string& capiUri) {
-
-				valid_ = false;
-
-				/* Syntax: "certstore:" [<cert_store> ":"] <cert_id> */
-
-				if (!boost::iequals(capiUri.substr(0, 10), "certstore:")) {
-					return;
-				}
-
-				/* Substring of subject: uses "storename" */
-				std::string capi_identity = capiUri.substr(10);
-				std::string new_cert_store_name;
-				size_t pos = capi_identity.find_first_of (':');
-
-				if (pos == std::string::npos) {
-					/* Using the default certificate store */
-					new_cert_store_name = "MY";
-					cert_name_ = capi_identity;
-				} else {
-					new_cert_store_name = capi_identity.substr(0, pos);
-					cert_name_ = capi_identity.substr(pos + 1);
-				}
+			CAPICertificate(const std::string& capiUri);
 
-				PCCERT_CONTEXT pCertContext = NULL;
+			virtual ~CAPICertificate();
 
-				if (cert_store_handle_ != NULL)
-				{
-					if (new_cert_store_name != cert_store_) {
-						CertCloseStore(cert_store_handle_, 0);
-						cert_store_handle_ = NULL;
-					}
-				}
+			virtual bool isNull() const;
 
-				if (cert_store_handle_ == NULL)
-				{
-					cert_store_handle_ = CertOpenSystemStore(0, cert_store_.c_str());
-					if (!cert_store_handle_)
-					{
-						return;
-					}
-				}
+			const std::string& getCertStoreName() const;
 
-				cert_store_ = new_cert_store_name;
+			const std::string& getCertName() const;
 
-				/* NB: This might have to change, depending on how we locate certificates */
-
-				// Find client certificate. Note that this sample just searches for a 
-				// certificate that contains the user name somewhere in the subject name.
-				pCertContext = CertFindCertificateInStore(cert_store_handle_,
-					X509_ASN_ENCODING,
-					0,				// dwFindFlags
-					CERT_FIND_SUBJECT_STR_A,
-					cert_name_.c_str(),		// *pvFindPara
-					NULL );				// pPrevCertContext
-
-				if (pCertContext == NULL)
-				{
-					return;
-				}
-
-
-				/* Now verify that we can have access to the corresponding private key */
-
-				DWORD len;
-				CRYPT_KEY_PROV_INFO *pinfo;
-				HCRYPTPROV hprov;
-				HCRYPTKEY key;
-
-				if (!CertGetCertificateContextProperty(pCertContext,
-								       CERT_KEY_PROV_INFO_PROP_ID,
-								       NULL,
-								       &len))
-				{
-					CertFreeCertificateContext(pCertContext);
-					return;
-				}
-
-				pinfo = static_cast<CRYPT_KEY_PROV_INFO *>(malloc(len));
-				if (!pinfo) {
-					CertFreeCertificateContext(pCertContext);
-					return;
-				}
-
-				if (!CertGetCertificateContextProperty(pCertContext,
-								       CERT_KEY_PROV_INFO_PROP_ID,
-								       pinfo,
-								       &len))
-				{
-					CertFreeCertificateContext(pCertContext);
-					free(pinfo);
-					return;
-				}
-
-				CertFreeCertificateContext(pCertContext);
-
-				// Now verify if we have access to the private key
-				if (!CryptAcquireContextW(&hprov,
-							  pinfo->pwszContainerName,
-							  pinfo->pwszProvName,
-							  pinfo->dwProvType,
-							  0))
-				{
-					free(pinfo);
-					return;
-				}
-
-				if (!CryptGetUserKey(hprov, pinfo->dwKeySpec, &key))
-				{
-					CryptReleaseContext(hprov, 0);
-					free(pinfo);
-					return;
-				}
-
-				CryptDestroyKey(key);
-				CryptReleaseContext(hprov, 0);
-				free(pinfo);
-
-				valid_ = true;
-			}
+		private:
+			void setUri (const std::string& capiUri);
 
 		private:
 			bool valid_;
 			std::string uri_;
 
-			HCERTSTORE cert_store_handle_;
+			HCERTSTORE certStoreHandle_;
 
 			/* Parsed components of the uri_ */
-			std::string cert_store_;
-			std::string cert_name_;
+			std::string certStore_;
+			std::string certName_;
 	};
 }
diff --git a/Swiften/TLS/CertificateWithKey.h b/Swiften/TLS/CertificateWithKey.h
index 6f6ea39..1bdeb03 100644
--- a/Swiften/TLS/CertificateWithKey.h
+++ b/Swiften/TLS/CertificateWithKey.h
@@ -1,32 +1,22 @@
 /*
  * Copyright (c) 2010-2012 Remko Tronçon
  * Licensed under the GNU General Public License v3.
  * See Documentation/Licenses/GPLv3.txt for more information.
  */
 
 #pragma once
 
 #include <Swiften/Base/SafeByteArray.h>
 
 namespace Swift {
 	class CertificateWithKey {
 		public:
+			typedef boost::shared_ptr<CertificateWithKey> ref;
 			CertificateWithKey() {}
 
 			virtual ~CertificateWithKey() {}
 
 			virtual bool isNull() const = 0;
 
-			virtual bool isPrivateKeyExportable() const = 0;
-
-			virtual const std::string& getCertStoreName() const = 0;
-
-			virtual const std::string& getCertName() const = 0;
-
-			virtual const ByteArray& getData() const = 0;
-
-			virtual void setData(const ByteArray& data) = 0;
-
-			virtual const SafeByteArray& getPassword() const = 0;
 	};
 }
diff --git a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
index dd3462f..8076967 100644
--- a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
+++ b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
@@ -154,92 +154,89 @@ void OpenSSLContext::handleDataFromNetwork(const SafeByteArray& data) {
 		case Connected:
 			sendPendingDataToApplication();
 			break;
 		case Start: assert(false); break;
 		case Error: /*assert(false);*/ break;
 	}
 }
 
 void OpenSSLContext::handleDataFromApplication(const SafeByteArray& data) {
 	if (SSL_write(handle_, vecptr(data), data.size()) >= 0) {
 		sendPendingDataToNetwork();
 	}
 	else {
 		state_ = Error;
 		onError();
 	}
 }
 
 void OpenSSLContext::sendPendingDataToApplication() {
 	SafeByteArray data;
 	data.resize(SSL_READ_BUFFERSIZE);
 	int ret = SSL_read(handle_, vecptr(data), data.size());
 	while (ret > 0) {
 		data.resize(ret);
 		onDataForApplication(data);
 		data.resize(SSL_READ_BUFFERSIZE);
 		ret = SSL_read(handle_, vecptr(data), data.size());
 	}
 	if (ret < 0 && SSL_get_error(handle_, ret) != SSL_ERROR_WANT_READ) {
 		state_ = Error;
 		onError();
 	}
 }
 
 bool OpenSSLContext::setClientCertificate(CertificateWithKey * certificate) {
-	if (!certificate || certificate->isNull()) {
-		return false;
-	}
-
-	if (!certificate->isPrivateKeyExportable()) {
+	boost::shared_ptr<PKCS12Certificate> pkcs12Certificate = boost::dynamic_pointer_cast<PKCS12Certificate>(certificate);
+	if (!pkcs12Certificate || pkcs12Certificate->isNull()) {
 		return false;
 	}
 
 	// Create a PKCS12 structure
 	BIO* bio = BIO_new(BIO_s_mem());
-	BIO_write(bio, vecptr(certificate->getData()), certificate->getData().size());
+	BIO_write(bio, vecptr(certificate->getData()), pkcs12Certificate->getData().size());
 	boost::shared_ptr<PKCS12> pkcs12(d2i_PKCS12_bio(bio, NULL), PKCS12_free);
 	BIO_free(bio);
 	if (!pkcs12) {
 		return false;
 	}
 
 	// Parse PKCS12
 	X509 *certPtr = 0;
 	EVP_PKEY* privateKeyPtr = 0;
 	STACK_OF(X509)* caCertsPtr = 0;
-	int result = PKCS12_parse(pkcs12.get(), reinterpret_cast<const char*>(vecptr(certificate->getPassword())), &privateKeyPtr, &certPtr, &caCertsPtr);
+	int result = PKCS12_parse(pkcs12.get(), reinterpret_cast<const char*>(vecptr(pkcs12Certificate->getPassword())), &privateKeyPtr, &certPtr, &caCertsPtr);
 	if (result != 1) { 
 		return false;
 	}
 	boost::shared_ptr<X509> cert(certPtr, X509_free);
 	boost::shared_ptr<EVP_PKEY> privateKey(privateKeyPtr, EVP_PKEY_free);
 	boost::shared_ptr<STACK_OF(X509)> caCerts(caCertsPtr, freeX509Stack);
 
 	// Use the key & certificates
 	if (SSL_CTX_use_certificate(context_, cert.get()) != 1) {
 		return false;
 	}
 	if (SSL_CTX_use_PrivateKey(context_, privateKey.get()) != 1) {
 		return false;
 	}
 	for (int i = 0;  i < sk_X509_num(caCerts.get()); ++i) {
 		SSL_CTX_add_extra_chain_cert(context_, sk_X509_value(caCerts.get(), i));
 	}
 	return true;
 }
 
 Certificate::ref OpenSSLContext::getPeerCertificate() const {
 	boost::shared_ptr<X509> x509Cert(SSL_get_peer_certificate(handle_), X509_free);
 	if (x509Cert) {
 		return boost::make_shared<OpenSSLCertificate>(x509Cert);
 	}
 	else {
 		return Certificate::ref();
 	}
 }
 
 boost::shared_ptr<CertificateVerificationError> OpenSSLContext::getPeerCertificateVerificationError() const {
 	int verifyResult = SSL_get_verify_result(handle_);
 	if (verifyResult != X509_V_OK) {
 		return boost::make_shared<CertificateVerificationError>(getVerificationErrorTypeForResult(verifyResult));
 	}
diff --git a/Swiften/TLS/OpenSSL/OpenSSLContext.h b/Swiften/TLS/OpenSSL/OpenSSLContext.h
index b53e715..e98fb49 100644
--- a/Swiften/TLS/OpenSSL/OpenSSLContext.h
+++ b/Swiften/TLS/OpenSSL/OpenSSLContext.h
@@ -1,53 +1,53 @@
 /*
  * Copyright (c) 2010 Remko Tronçon
  * Licensed under the GNU General Public License v3.
  * See Documentation/Licenses/GPLv3.txt for more information.
  */
 
 #pragma once
 
 #include <openssl/ssl.h>
 #include <Swiften/Base/boost_bsignals.h>
 #include <boost/noncopyable.hpp>
 
 #include <Swiften/TLS/TLSContext.h>
 #include <Swiften/Base/ByteArray.h>
 
 namespace Swift {
 	class CertificateWithKey;
 
 	class OpenSSLContext : public TLSContext, boost::noncopyable {
 		public:
 			OpenSSLContext();
 			~OpenSSLContext();
 
 			void connect();
-			bool setClientCertificate(CertificateWithKey * cert);
+			bool setClientCertificate(CertificateWithKey::ref cert);
 
 			void handleDataFromNetwork(const SafeByteArray&);
 			void handleDataFromApplication(const SafeByteArray&);
 
 			Certificate::ref getPeerCertificate() const;
 			boost::shared_ptr<CertificateVerificationError> getPeerCertificateVerificationError() const;
 
 			virtual ByteArray getFinishMessage() const;
 
 		private:
 			static void ensureLibraryInitialized();	
 
 			static CertificateVerificationError::Type getVerificationErrorTypeForResult(int);
 
 			void doConnect();
 			void sendPendingDataToNetwork();
 			void sendPendingDataToApplication();
 
 		private:
 			enum State { Start, Connecting, Connected, Error };
 
 			State state_;
 			SSL_CTX* context_;
 			SSL* handle_;
 			BIO* readBIO_;
 			BIO* writeBIO_;
 	};
 }
diff --git a/Swiften/TLS/SConscript b/Swiften/TLS/SConscript
index a71a446..0e95b8b 100644
--- a/Swiften/TLS/SConscript
+++ b/Swiften/TLS/SConscript
@@ -1,33 +1,34 @@
 Import("swiften_env")
 
 objects = swiften_env.SwiftenObject([
 			"Certificate.cpp",
 			"CertificateFactory.cpp",
 			"CertificateTrustChecker.cpp",
 			"ServerIdentityVerifier.cpp",
 			"TLSContext.cpp",
 			"TLSContextFactory.cpp",
 		])
 		
 myenv = swiften_env.Clone()
 if myenv.get("HAVE_OPENSSL", 0) :
 	myenv.MergeFlags(myenv["OPENSSL_FLAGS"])
 	objects += myenv.SwiftenObject([
 			"OpenSSL/OpenSSLContext.cpp",
 			"OpenSSL/OpenSSLCertificate.cpp",
 			"OpenSSL/OpenSSLContextFactory.cpp",
 		])
 	myenv.Append(CPPDEFINES = "HAVE_OPENSSL")
 elif myenv.get("HAVE_SCHANNEL", 0) :
 	objects += myenv.StaticObject([
+			"CAPICertificate.cpp",
 			"Schannel/SchannelContext.cpp",
 			"Schannel/SchannelCertificate.cpp",
 			"Schannel/SchannelContextFactory.cpp",
 		])
 	myenv.Append(CPPDEFINES = "HAVE_SCHANNEL")
 
 objects += myenv.SwiftenObject(["PlatformTLSFactories.cpp"])
 
 		
 
 swiften_env.Append(SWIFTEN_OBJECTS = [objects])
diff --git a/Swiften/TLS/Schannel/SchannelContext.cpp b/Swiften/TLS/Schannel/SchannelContext.cpp
index 6f50b3a..ddbebcb 100644
--- a/Swiften/TLS/Schannel/SchannelContext.cpp
+++ b/Swiften/TLS/Schannel/SchannelContext.cpp
@@ -1,55 +1,56 @@
 /*
  * Copyright (c) 2011 Soren Dreijer
  * Licensed under the simplified BSD license.
  * See Documentation/Licenses/BSD-simplified.txt for more information.
  */
 
-#include "Swiften/TLS/Schannel/SchannelContext.h"
-#include "Swiften/TLS/Schannel/SchannelCertificate.h"
+#include <Swiften/TLS/Schannel/SchannelContext.h>
+#include <Swiften/TLS/Schannel/SchannelCertificate.h>
+#include <Swiften/TLS/CAPICertificate.h>
 
 namespace Swift {
 
 //------------------------------------------------------------------------
 
 SchannelContext::SchannelContext() 
 : m_state(Start)
 , m_secContext(0)
 , m_verificationError(CertificateVerificationError::UnknownError)
 , m_my_cert_store(NULL)
 , m_cert_store_name("MY")
-, m_cert_name(NULL)
+, m_cert_name()
 {
 	m_ctxtFlags = ISC_REQ_ALLOCATE_MEMORY | 
 				  ISC_REQ_CONFIDENTIALITY |
 				  ISC_REQ_EXTENDED_ERROR  |
 				  ISC_REQ_INTEGRITY		  |
 				  ISC_REQ_REPLAY_DETECT   |	
 				  ISC_REQ_SEQUENCE_DETECT |
 				  ISC_REQ_USE_SUPPLIED_CREDS |
 				  ISC_REQ_STREAM;
 
 	ZeroMemory(&m_streamSizes, sizeof(m_streamSizes));
 }
 
 //------------------------------------------------------------------------
 
 SchannelContext::~SchannelContext()
 {
 	if (m_my_cert_store) CertCloseStore(m_my_cert_store, 0);
 }
 
 //------------------------------------------------------------------------
 
 void SchannelContext::determineStreamSizes()
 {
 	QueryContextAttributes(m_ctxtHandle, SECPKG_ATTR_STREAM_SIZES, &m_streamSizes);
 }
 
 //------------------------------------------------------------------------
 
 void SchannelContext::connect() 
 {
 	PCCERT_CONTEXT   pCertContext = NULL;
 
 	m_state = Connecting;
 
@@ -485,86 +486,82 @@ void SchannelContext::encryptAndSendData(const SafeByteArray& data)
 		outBuffers[0].cbBuffer	 = m_streamSizes.cbHeader;
 		outBuffers[0].BufferType = SECBUFFER_STREAM_HEADER;
 
 		outBuffers[1].pvBuffer	 = &sendBuffer[0] + m_streamSizes.cbHeader;
 		outBuffers[1].cbBuffer	 = (unsigned long)bytesToSend;
 		outBuffers[1].BufferType = SECBUFFER_DATA;
 
 		outBuffers[2].pvBuffer	 = &sendBuffer[0] + m_streamSizes.cbHeader + bytesToSend;
 		outBuffers[2].cbBuffer	 = m_streamSizes.cbTrailer;
 		outBuffers[2].BufferType = SECBUFFER_STREAM_TRAILER;
 
 		outBuffers[3].pvBuffer   = 0;
 		outBuffers[3].cbBuffer   = 0;
 		outBuffers[3].BufferType = SECBUFFER_EMPTY;
 
 		SecBufferDesc outBufferDesc = {0};
 		outBufferDesc.cBuffers   = 4;
 		outBufferDesc.pBuffers   = outBuffers;
 		outBufferDesc.ulVersion  = SECBUFFER_VERSION;
 
 		SECURITY_STATUS status = EncryptMessage(m_ctxtHandle, 0, &outBufferDesc, 0);
 		if (status != SEC_E_OK) 
 		{
 			indicateError();
 			return;
 		}
 
 		sendDataOnNetwork(&sendBuffer[0], outBuffers[0].cbBuffer + outBuffers[1].cbBuffer + outBuffers[2].cbBuffer);
 		bytesSent += bytesToSend;
 
 	} while (bytesSent < data.size());
 }
 
 //------------------------------------------------------------------------
 
-bool SchannelContext::setClientCertificate(CertificateWithKey * certificate)
+bool SchannelContext::setClientCertificate(CertificateWithKey::ref certificate)
 {
-	if (!certificate || certificate->isNull()) {
+	boost::shared_ptr<CAPICertificate> capiCertificate = boost::dynamic_pointer_cast<CAPICertificate>(certificate);
+	if (!capiCertificate || capiCertificate->isNull()) {
 		return false;
 	}
 
-	if (!certificate->isPrivateKeyExportable()) {
-		// We assume that the Certificate Store Name/Certificate Name
-		// are valid at this point
-		m_cert_store_name = certificate->getCertStoreName();
-		m_cert_name = certificate->getCertName();
-
-		return true;
-	}
-
-	return false;
+	// We assume that the Certificate Store Name/Certificate Name
+	// are valid at this point
+	m_cert_store_name = capiCertificate->getCertStoreName();
+	m_cert_name = capiCertificate->getCertName();
+	return true;
 }
 
 //------------------------------------------------------------------------
 
 Certificate::ref SchannelContext::getPeerCertificate() const 
 {
 	SchannelCertificate::ref pCertificate;
 
 	ScopedCertContext pServerCert;
 	SECURITY_STATUS status = QueryContextAttributes(m_ctxtHandle, SECPKG_ATTR_REMOTE_CERT_CONTEXT, pServerCert.Reset());
 	if (status != SEC_E_OK)
 		return pCertificate;
 
 	pCertificate.reset( new SchannelCertificate(pServerCert) );
 	return pCertificate;
 }
 
 //------------------------------------------------------------------------
 
 CertificateVerificationError::ref SchannelContext::getPeerCertificateVerificationError() const 
 {
 	boost::shared_ptr<CertificateVerificationError> pCertError;
 
 	if (m_state == Error)
 		pCertError.reset( new CertificateVerificationError(m_verificationError) );
 	
 	return pCertError;
 }
 
 //------------------------------------------------------------------------
 
 ByteArray SchannelContext::getFinishMessage() const
 {
 	// TODO: Implement
 
diff --git a/Swiften/TLS/Schannel/SchannelContext.h b/Swiften/TLS/Schannel/SchannelContext.h
index 0cdb3d7..7726c41 100644
--- a/Swiften/TLS/Schannel/SchannelContext.h
+++ b/Swiften/TLS/Schannel/SchannelContext.h
@@ -5,71 +5,71 @@
  */
 
 #pragma once
 
 #include "Swiften/Base/boost_bsignals.h"
 
 #include "Swiften/TLS/TLSContext.h"
 #include "Swiften/TLS/Schannel/SchannelUtil.h"
 #include <Swiften/TLS/CertificateWithKey.h>
 #include "Swiften/Base/ByteArray.h"
 
 #define SECURITY_WIN32
 #include <Windows.h>
 #include <Schannel.h>
 #include <security.h>
 #include <schnlsp.h>
 
 #include <boost/noncopyable.hpp>
 
 namespace Swift 
 {	
 	class SchannelContext : public TLSContext, boost::noncopyable 
 	{
 	public:
 		typedef boost::shared_ptr<SchannelContext> sp_t;
 
 	public:
 		SchannelContext();
 
 		~SchannelContext();
 
 		//
 		// TLSContext
 		//
 		virtual void	connect();
-		virtual bool	setClientCertificate(CertificateWithKey * cert);
+		virtual bool	setClientCertificate(CertificateWithKey::ref cert);
 
 		virtual void	handleDataFromNetwork(const SafeByteArray& data);
 		virtual void	handleDataFromApplication(const SafeByteArray& data);
 
 		virtual Certificate::ref getPeerCertificate() const;
 		virtual CertificateVerificationError::ref getPeerCertificateVerificationError() const;
 
 		virtual ByteArray getFinishMessage() const;
 
 	private:
 		void			determineStreamSizes();
 		void			continueHandshake(const SafeByteArray& data);
 		void			indicateError();
 
 		void			sendDataOnNetwork(const void* pData, size_t dataSize);
 		void			forwardDataToApplication(const void* pData, size_t dataSize);
 
 		void			decryptAndProcessData(const SafeByteArray& data);
 		void			encryptAndSendData(const SafeByteArray& data);
 
 		void			appendNewData(const SafeByteArray& data);
 
 	private:
 		enum SchannelState
 		{
 			Start,
 			Connecting,
 			Connected,
 			Error
 
 		};
 
 		SchannelState		m_state;
 		CertificateVerificationError m_verificationError;
 
diff --git a/Swiften/TLS/TLSContext.h b/Swiften/TLS/TLSContext.h
index ada813a..9dee902 100644
--- a/Swiften/TLS/TLSContext.h
+++ b/Swiften/TLS/TLSContext.h
@@ -1,41 +1,41 @@
 /*
  * Copyright (c) 2010 Remko Tronçon
  * Licensed under the GNU General Public License v3.
  * See Documentation/Licenses/GPLv3.txt for more information.
  */
 
 #pragma once
 
 #include <Swiften/Base/boost_bsignals.h>
 #include <boost/shared_ptr.hpp>
 
 #include <Swiften/Base/SafeByteArray.h>
 #include <Swiften/TLS/Certificate.h>
+#include <Swiften/TLS/CertificateWithKey.h>
 #include <Swiften/TLS/CertificateVerificationError.h>
 
 namespace Swift {
-	class CertificateWithKey;
 
 	class TLSContext {
 		public:
 			virtual ~TLSContext();
 
 			virtual void connect() = 0;
 
-			virtual bool setClientCertificate(CertificateWithKey * cert) = 0;
+			virtual bool setClientCertificate(CertificateWithKey::ref cert) = 0;
 
 			virtual void handleDataFromNetwork(const SafeByteArray&) = 0;
 			virtual void handleDataFromApplication(const SafeByteArray&) = 0;
 
 			virtual Certificate::ref getPeerCertificate() const = 0;
 			virtual CertificateVerificationError::ref getPeerCertificateVerificationError() const = 0;
 
 			virtual ByteArray getFinishMessage() const = 0;
 
 		public:
 			boost::signal<void (const SafeByteArray&)> onDataForNetwork;
 			boost::signal<void (const SafeByteArray&)> onDataForApplication;
 			boost::signal<void ()> onError;
 			boost::signal<void ()> onConnected;
 	};
 }