unit JwaWinCrypt;
...
function CryptSignMessage( var pSignPara : CRYPT_SIGN_MESSAGE_PARA;
                           fDetachedSignature : BOOL;
                           cToBeSigned :DWORD;
                     const rgpbToBeSigned : PByteArray;
                           rgcbToBeSigned : PDWordArray;
                           pbSignedBlob : PBYTE;
                           var pcbSignedBlob : DWORD ) : BOOL; stdcall;
....

unit Main;

uses jwaWinScrypt...

// обрабатываем ошибки
procedure Err( const msg : String );
var
  dwError, dwLen : DWORD;
  sError, sErrorDecode : String;
  pBuffer : Cardinal;
begin
  dwError := GetLastError;
  dwLen := FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM or
                          FORMAT_MESSAGE_ARGUMENT_ARRAY or
                          FORMAT_MESSAGE_ALLOCATE_BUFFER,
                          nil, dwError, 0, @pBuffer, 0, nil );
  try
    SetString( sErrorDecode, PChar( pBuffer ), dwLen );
  finally
    LocalFree( pBuffer );
  end;
  sError := Format( '%s'#10#13'0x%x %s', [ msg, dwError, sErrorDecode ] );
  frmSignatureFromCertificate.mDestination.Lines.Text := msg;
  Raise Exception.Create( sError );
end;

// подписываем содержимое одного Memo-поля, выводим в другое Memo поле
procedure TfrmSignatureFromCertificate.acSignFileExecute(Sender: TObject);
const
  CERT_STORE_NAME = 'MY';
  MY_ENCODING_TYPE = PKCS_7_ASN_ENCODING or X509_ASN_ENCODING;
  SignerName : WideString = 'Shuraken';
var
  pSignerCert: PCCERT_CONTEXT;
  hCertStoreHandle: HCERTSTORE;
  SigParams: CRYPT_SIGN_MESSAGE_PARA;
  pStreamIn, pStreamOut: TMemoryStream;
  MessageArray : TByteArray;
  MessageSize : TDWordArray;
  MessageCert : TPCCertContextArray;
  cbSignedMessageBlob: DWORD;
  SignName: WideString;
begin
  mDestination.Clear;
  hCertStoreHandle := CertOpenSystemStore( 0, PChar( CERT_STORE_NAME ));
  if ( not assigned( hCertStoreHandle )) then
    Err( Format( 'Ошибка при открытии хранилища: %s', [ CERT_STORE_NAME ] ));
  try
    SignName := Trim(cmbCertificates.Text);
    pSignerCert := CertFindCertificateInStore( hCertStoreHandle, MY_ENCODING_TYPE, 0, CERT_FIND_SUBJECT_STR, PWideChar( SignName ), nil );
    try
      if ( not assigned( pSignerCert )) then
        Err( Format( 'Сертификат %s не найден', [ SignName ] ));
      pStreamIn := TMemoryStream.Create;
      pStreamOut := TMemoryStream.Create;
      try
        mSource.Lines.SaveToStream(pStreamIn);
        GetMem( MessageArray, 1 * SizeOf( PByte ));
        GetMem( MessageSize, 1 * SizeOf( DWORD ));
        GetMem( MessageCert, 1 * SizeOf( PPCCERT_CONTEXT ));
        MessageArray[ 0 ] := pStreamIn.Memory;
        MessageSize[ 0 ] := pStreamIn.Size;
        MessageCert[ 0 ] := pSignerCert;
        FillChar( SigParams, SizeOf( CRYPT_SIGN_MESSAGE_PARA ), 0 );
        SigParams.cbSize := SizeOF( CRYPT_SIGN_MESSAGE_PARA );
        SigParams.dwMsgEncodingType := MY_ENCODING_TYPE;
        SigParams.pSigningCert := pSignerCert;
        SigParams.HashAlgorithm.pszObjId := szOID_RSA_MD5;
        SigParams.cMsgCert := 1;
        SigParams.rgpMsgCert := Pointer( MessageCert );
        if ( not ( CryptSignMessage( SigParams, false, 1, Pointer( MessageArray ), Pointer( MessageSize ), nil, cbSignedMessageBlob ))) then
          Err( 'Размер буфера' );
        pStreamOut.Size := cbSignedMessageBlob;
        if not ( CryptSignMessage( SigParams, false, 1, Pointer( MessageArray ), Pointer( MessageSize ), pStreamOut.Memory, cbSignedMessageBlob )) then
          Err( 'Файл не подписан' );
        pStreamOut.Size := cbSignedMessageBlob;

        mDestination.Lines.LoadFromStream(pStreamOut);
      finally
        FreeAndNil( pStreamIn );
        FreeAndNil( pStreamOut );
      end;
    finally
      CertFreeCertificateContext(pSignerCert);
    end;
  finally
    CertCloseStore( hCertStoreHandle, CERT_CLOSE_STORE_CHECK_FLAG );
  end;
end;

// выводим список личных сертификатов
procedure TfrmSignatureFromCertificate.FormShow(Sender: TObject);
var
  hProv       : HCRYPTPROV;
  hStoreHandle: hcertstore;
  pSignerCert : PCCERT_CONTEXT;
  pCertContext: PCCERT_CONTEXT;
  len: integer;
  CertName: PByte;

function CertNameToWideString: WideString;
begin
  if (len = 0) then
  begin
    Result := '';
    Exit;
  end;

  SetLength(Result, len div 2);
  System.Move(CertName^, Pointer(Result)^, len);
  len := Length(Result);
  if (Result[len] = #0) then
  begin
    Dec(len);
    SetLength(Result, len);
  end;
end;

begin

  if not CryptAcquireContext(hProv, nil, nil, PROV_RSA_SIG, CRYPT_VERIFYCONTEXT) then
    exit;

  hStoreHandle := CertOpenSystemStore(hProv, 'MY');
  if (hStoreHandle = nil) then
  begin
    Err('ErrorOpenStore');
    exit;
  end;

  pCertContext := nil;
  repeat
    pCertContext := CertEnumCertificatesInStore(hStoreHandle, pCertContext);
    if (pCertContext <> nil) then
    begin
      len := CertGetNameString(pCertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, nil, nil, 0);
      if len > 0 then
      begin
        len := len*2;
        GetMem(CertName, len);
        CertGetNameStringW(pCertContext, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, nil, PWideChar(CertName), len);
        cmbCertificates.Items.Add(CertNameToWideString);
        FreeMem(CertName);
        CertName := nil;
      end;
    end;
  until (pCertContext = nil);
  cmbCertificates.ItemIndex := 0;
end;