var
  Prov: HCRYPTPROV;
  hKey: HCRYPTKEY;
  UserCert: AnsiString;
  UserCertLength: DWORD;
  UserCertBase64: AnsiString;
begin
  if not CryptAcquireContext(Prov, PAnsiChar(ContainerName), PAnsiChar(CP_GR3410_2001_PROV_A), PROV_GOST_2001_DH, 0) then
    CryptoError('CryptAcquireContext');
  try
    if not CryptGetUserKey(Prov, AT_KEYEXCHANGE, hKey) then
      CryptoError('CryptGetUserKey');

    if not CryptGetKeyParam(hKey, KP_CERTIFICATE, nil, UserCertLength, 0) then
      CryptoError('CryptGetKeyParam(KP_CERTIFICATE length)');

    if UserCertLength = 0 then
      Assert(False);
    SetLength(UserCert, UserCertLength);

    if not CryptGetKeyParam(hKey, KP_CERTIFICATE, PByte(UserCert), UserCertLength, 0) then
      CryptoError('CryptGetKeyParam(KP_CERTIFICATE data)');

    UserCertBase64 := Base64EncodeStr(UserCert);
  finally
    CryptReleaseContext(Prov, 0);
  end;