diff --git a/libmariadb/secure/schannel_certs.c b/libmariadb/secure/schannel_certs.c
index 9762f14..e1e355d 100644
--- a/libmariadb/secure/schannel_certs.c
+++ b/libmariadb/secure/schannel_certs.c
@@ -142,6 +142,82 @@ cleanup:
   return file_buffer;
 }
 
+/*
+  Load file into memory. Add null terminator at the end, so it will be a valid C string.
+*/
+static char* pem_file_to_blob(CERT_BLOB *outData, const char* file, char* errmsg, size_t errmsg_len)
+{
+  LARGE_INTEGER file_size;
+  size_t file_bufsize = 0;
+  size_t total_bytes_read = 0;
+  char* file_buffer = NULL;
+  SECURITY_STATUS status = SEC_E_OK;
+
+  HANDLE file_handle = CreateFile(file, GENERIC_READ, FILE_SHARE_READ, NULL,
+    OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+  if (file_handle == INVALID_HANDLE_VALUE)
+  {
+    FAIL("failed to open file '%s'", file);
+  }
+
+  if (!GetFileSizeEx(file_handle, &file_size))
+  {
+    FAIL("GetFileSizeEx failed on '%s'", file);
+  }
+
+  if (file_size.QuadPart > ULONG_MAX - 1)
+  {
+    SetLastError(SEC_E_INVALID_PARAMETER);
+    FAIL("file '%s' too large", file);
+  }
+
+  file_bufsize = (size_t)file_size.QuadPart;
+  file_buffer = (char*)LocalAlloc(0,file_bufsize);
+  if (!file_buffer)
+  {
+    FAIL("LocalAlloc(0,%zu) failed", file_bufsize);
+  }
+
+  while (total_bytes_read < file_bufsize)
+  {
+    DWORD bytes_to_read = (DWORD)(file_bufsize - total_bytes_read);
+    DWORD bytes_read = 0;
+
+    if (!ReadFile(file_handle, file_buffer + total_bytes_read,
+      bytes_to_read, &bytes_read, NULL))
+    {
+      FAIL("ReadFile() failed to read  file '%s'", file);
+    }
+    if (bytes_read == 0)
+    {
+      /* Premature EOF -- adjust the bufsize to the new value */
+      file_bufsize = total_bytes_read;
+    }
+    else
+    {
+      total_bytes_read += bytes_read;
+    }
+  }
+
+cleanup:
+  if (file_handle != INVALID_HANDLE_VALUE)
+  {
+    CloseHandle(file_handle);
+  }
+  if (status)
+  {
+    /* Some error happened. */
+    LocalFree(file_buffer);
+    file_buffer = NULL;
+  }
+
+  if (file_buffer) {
+    outData->pbData = (BYTE*)file_buffer;
+    outData->cbData = (DWORD)file_bufsize;
+  }
+  return file_buffer;
+}
+
 
 // Structure for parsing BEGIN/END sections inside pem.
 typedef struct _pem_type_desc
@@ -780,38 +856,78 @@ cleanup:
  create a client certificate*
 */
 static SECURITY_STATUS create_client_certificate_mem(
+#if 0
   char* cert_file_content,
   char* key_file_content,
+#else
+  CRYPT_DATA_BLOB* cert_file_content,
+#endif
   client_cert_handle* cert_handle,
   char* errmsg,
   size_t errmsg_len)
 {
-  char* begin;
-  char* end;
-  CERT_BLOB cert_blob;
-  DWORD actual_content_type = 0;
   SECURITY_STATUS status = SEC_E_OK;
+#if 0 // not P12
+  char *remaining_cert_file_content;
+  char *begin = NULL, *end = NULL;
+  DWORD actual_content_type = 0;
 
-  /* Parse certificate */
-  pem_locate(cert_file_content, PEM_TYPE_CERTIFICATE,
-    &begin, &end);
-
-  if (!begin || !end)
-  {
-    SetLastError(SEC_E_INVALID_PARAMETER);
-    FAIL("Client certificate not found in PEM file");
+  /* Parse certificates */
+  remaining_cert_file_content = cert_file_content;
+  cert_handle->cert_store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, (HCRYPTPROV)NULL,
+    CERT_STORE_CREATE_NEW_FLAG, NULL);
+  if (!cert_handle->cert_store) {
+    FAIL("CertOpenStore failed for memory store");
   }
+  /* parse the additional certificates in the file, if any */
+  do {
+    CERT_BLOB cert_blob;
+    pem_locate(remaining_cert_file_content, PEM_TYPE_CERTIFICATE,
+      &begin, &end);
+    if (!begin || !end)
+    {
+      if (cert_handle->cert == 0)
+      {
+        SetLastError(SEC_E_INVALID_PARAMETER);
+        FAIL("Client certificate not found in PEM file");
+      }
+      else
+        break;
+    }
+    remaining_cert_file_content = end;
 
-  cert_blob.pbData = (BYTE*)begin;
-  cert_blob.cbData = (DWORD)(end - begin);
-  if (!CryptQueryObject(
-    CERT_QUERY_OBJECT_BLOB, &cert_blob,
-    CERT_QUERY_CONTENT_FLAG_CERT,
-    CERT_QUERY_FORMAT_FLAG_ALL, 0, NULL, &actual_content_type,
-    NULL, NULL, NULL, (const void**)&cert_handle->cert))
-  {
-    FAIL("Can't parse client certficate");
-  }
+    //TODO: read the cert and add it to cert store
+    cert_blob.pbData = (BYTE*)begin;
+    cert_blob.cbData = (DWORD)(end - begin);
+    if (cert_handle->cert == NULL)
+    {
+      PCCERT_CONTEXT import_cert;
+      if (!CryptQueryObject(
+        CERT_QUERY_OBJECT_BLOB, &cert_blob,
+        CERT_QUERY_CONTENT_FLAG_CERT,
+        CERT_QUERY_FORMAT_FLAG_ALL, 0, NULL, &actual_content_type,
+        NULL, NULL, NULL, (const void**)&import_cert))
+      {
+        FAIL("Can't parse client certficate");
+      }
+      if (!CertAddCertificateContextToStore(cert_handle->cert_store,
+        import_cert,
+        CERT_STORE_ADD_NEW, &cert_handle->cert))
+      {
+        CertFreeCertificateContext(import_cert);
+        FAIL("Can't add client certificate to store");
+      }
+      CertFreeCertificateContext(import_cert);
+    } else {
+      if (!CertAddEncodedCertificateToStore(cert_handle->cert_store,
+        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+        cert_blob.pbData, cert_blob.cbData,
+        CERT_STORE_ADD_NEW, NULL) == FALSE)
+      {
+        FAIL("Can't add additional certificate to store");
+      }
+    }
+  } while (remaining_cert_file_content != NULL);
 
   /* Parse key */
   PEM_TYPE types[] = { PEM_TYPE_RSA_PRIVATE_KEY, PEM_TYPE_PRIVATE_KEY };
@@ -832,6 +948,49 @@ static SECURITY_STATUS create_client_certificate_mem(
     FAIL("Client private key not found in PEM");
   }
 
+#else
+  cert_handle->cert_store = PFXImportCertStore(cert_file_content, NULL, PKCS12_NO_PERSIST_KEY);
+  if (!cert_handle->cert_store)
+  {
+    FAIL("PFXImportCertStore failed, input is not a valid P12/PFX");
+  }
+  PCCERT_CONTEXT cert = NULL;
+  while ((cert = CertEnumCertificatesInStore(cert_handle->cert_store, cert)) != NULL)
+  {
+    DWORD cbSize;
+    CHAR szName[1024];
+    if (!cert) break;
+
+    if (0 != CertGetNameStringA(cert, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, NULL, szName, sizeof(szName))) {
+      printf(TEXT("\nSubject -> %s.\n"), szName);
+    }
+  }
+
+  PCCTL_CONTEXT ctl = NULL;
+  while ((ctl = CertEnumCTLsInStore(cert_handle->cert_store, ctl)) != NULL)
+  {
+   if (!ctl)
+    break;
+  }
+#if 1
+  cert_handle->cert = CertFindCertificateInStore(cert_handle->cert_store,
+    X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+    0,
+    CERT_FIND_HAS_PRIVATE_KEY,
+    NULL,
+    NULL);
+  if (!cert_handle->cert)
+  {
+    FAIL("No certificate found in PFX/P12 store");
+    if (cert_handle->cert_store) {
+      CertCloseStore(cert_handle->cert_store, 0);
+      cert_handle->cert_store = NULL;
+    }
+    FAIL("No certificate with private key found in PFX/P12 store");
+  }
+#endif
+
+#endif
 cleanup:
   return status;
 }
@@ -848,6 +1007,7 @@ SECURITY_STATUS schannel_create_cert_context(char* cert_file, char* key_file,
 
   memset(cert_handle, 0, sizeof(client_cert_handle));
 
+#if 0
   cert_file_content = pem_file_to_string(cert_file, errmsg, errmsg_len);
 
   if (!cert_file_content)
@@ -865,6 +1025,12 @@ SECURITY_STATUS schannel_create_cert_context(char* cert_file, char* key_file,
   }
 
   status = create_client_certificate_mem(cert_file_content, key_file_content, cert_handle, errmsg, errmsg_len);
+ #else
+  CRYPT_DATA_BLOB cert_blob = {0, NULL};
+
+  pem_file_to_blob(&cert_blob, cert_file, errmsg, errmsg_len);
+  status = create_client_certificate_mem(&cert_blob, cert_handle, errmsg, errmsg_len);
+ #endif 
 
 cleanup:
   LocalFree(cert_file_content);
@@ -905,5 +1071,9 @@ void schannel_free_cert_context(client_cert_handle* cert_handle)
     }
     cert_handle->key_container_name[0] = 0;
   }
+  if (cert_handle->cert_store) {
+    CertCloseStore(cert_handle->cert_store, 0);
+    cert_handle->cert_store = NULL;
+  }
   cert_handle->flags= 0;
 }
diff --git a/libmariadb/secure/schannel_certs.h b/libmariadb/secure/schannel_certs.h
index 8e0152f..a486882 100644
--- a/libmariadb/secure/schannel_certs.h
+++ b/libmariadb/secure/schannel_certs.h
@@ -25,6 +25,7 @@ typedef struct _client_cert_handle {
   HCRYPTPROV prov; /* provider */
   HCRYPTKEY  key;  /* private key */
   PCCERT_CONTEXT cert; /* client certificate */
+  HCERTSTORE cert_store; /* certificate store */
   DWORD flags; /* Flags used in CryptAcquireContext, e.g CRYPT_MACHINE_KEYSET*/
   wchar_t key_container_name[64]; /* key container name */
 } client_cert_handle;
