Add option to ignore a not found CNG key

Author: djboris9

certtostore_windows.go

@@ -336,6 +336,9 @@ type WinCertStoreOptions struct {
 	//   - certStoreCreateNewFlag: Create new store if it doesn't exist
 	//   - certStoreOpenExistingFlag: Only open existing stores
 	StoreFlags uint32
+
+	// IgnoreNoCNG can be set in order to ignore a not found CNG key when a CAPI key exists.
+	IgnoreNoCNG bool
 }
 
 // WinCertStore is a CertStorage implementation for the Windows Certificate Store.
@@ -350,6 +353,7 @@ type WinCertStore struct {
 	stores              map[string]*storeHandle
 	keyAccessFlags      uintptr
 	storeFlags          uint32
+	ignoreNoCNG         bool
 
 	mu sync.Mutex
 }
@@ -376,6 +380,7 @@ func DefaultWinCertStoreOptions(provider, container string, issuers, intermediat
 		LegacyKey:           legacyKey,
 		CurrentUser:         false,
 		StoreFlags:          0,
+		IgnoreNoCNG:         false,
 	}
 }
 
@@ -443,6 +448,7 @@ func OpenWinCertStoreWithOptions(opts WinCertStoreOptions) (*WinCertStore, error
 		container:           opts.Container,
 		stores:              make(map[string]*storeHandle),
 		storeFlags:          opts.StoreFlags,
+		ignoreNoCNG:         opts.IgnoreNoCNG,
 	}
 
 	// Deep copy the issuer slices to prevent external modification
@@ -1366,6 +1372,11 @@ func keyMetadata(kh uintptr, store *WinCertStore) (*Key, error) {
 		if err != nil {
 			return nil, err
 		}
+
+		if !store.ignoreNoCNG && uc == "" {
+			// key is not CNG backed, but store was opened with ignoreNoCNG=false
+			return nil, errors.New("CNG key was empty")
+		}
 	}
 
 	alg, err := getPropertyStr(kh, nCryptAlgorithmGroupProperty)