--- a/lib/nettle/sysrng-windows.c
+++ b/lib/nettle/sysrng-windows.c
@@ -46,19 +46,19 @@
  */
 
 #include <windows.h>
-#include <wincrypt.h>
+#include <bcrypt.h>
 
-static HCRYPTPROV device_fd = 0;
+static BCRYPT_ALG_HANDLE bdevice_fd = 0;
 
 static
 int _rnd_get_system_entropy_win32(void* rnd, size_t size)
 {
-	if (!CryptGenRandom(device_fd, (DWORD) size, rnd)) {
-		_gnutls_debug_log("Error in CryptGenRandom: %d\n",
-					(int)GetLastError());
+	NTSTATUS ret = BCryptGenRandom(bdevice_fd, rnd, (ULONG)size, 0);
+	if (!(BCRYPT_SUCCESS(ret))) {
+		_gnutls_debug_log("Error in BCryptGenRandom: %d\n",
+			(int)GetLastError());
 		return GNUTLS_E_RANDOM_DEVICE_ERROR;
 	}
-
 	return 0;
 }
 
@@ -69,19 +69,19 @@ int _rnd_system_entropy_check(void)
 
 int _rnd_system_entropy_init(void)
 {
-	if (!CryptAcquireContext
-		(&device_fd, NULL, NULL, PROV_RSA_FULL,
-		 CRYPT_SILENT | CRYPT_VERIFYCONTEXT)) {
+	NTSTATUS ret = BCryptOpenAlgorithmProvider(&bdevice_fd,
+		BCRYPT_RNG_ALGORITHM, MS_PRIMITIVE_PROVIDER,
+		0);
+	if (!(BCRYPT_SUCCESS(ret))) {
 		_gnutls_debug_log
-			("error in CryptAcquireContext!\n");
+		("error in BCryptOpenAlgorithmProvider!\n");
 		return GNUTLS_E_RANDOM_DEVICE_ERROR;
 	}
-
 	_rnd_get_system_entropy = _rnd_get_system_entropy_win32;
 	return 0;
 }
 
 void _rnd_system_entropy_deinit(void)
 {
-	CryptReleaseContext(device_fd, 0);
+	BCryptCloseAlgorithmProvider(bdevice_fd, 0);
 }
--- a/lib/opencdk/misc.c
+++ b/lib/opencdk/misc.c
@@ -149,6 +149,12 @@ int _cdk_check_args(int overwrite, const char *in, const char *out)
 }
 
 #ifdef _WIN32
+#if (_WIN32_WINNT >= 0x0600)
+FILE *_cdk_tmpfile(void)
+{
+	return NULL;
+}
+#else
 #include <io.h>
 #include <fcntl.h>
 
@@ -183,6 +189,7 @@ FILE *_cdk_tmpfile(void)
 	_close(fd);
 	return NULL;
 }
+#endif /*_WIN32*/
 #else
 FILE *_cdk_tmpfile(void)
 {
--- a/lib/system.c
+++ b/lib/system.c
@@ -34,7 +34,7 @@
 
 #ifdef _WIN32
 # include <windows.h>
-# include <wincrypt.h>
+# include <bcrypt.h>
 # if defined(NEED_CERT_ENUM_CRLS)
 CertEnumCRLsInStoreFunc pCertEnumCRLsInStore;
 static HMODULE Crypt32_dll;
--- a/lib/system/certs.c
+++ b/lib/system/certs.c
@@ -161,9 +161,17 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
 		gnutls_datum_t data;
 
 		if (i == 0)
-			store = CertOpenSystemStore(0, "ROOT");
+			store = CertOpenStore(CERT_STORE_PROV_SYSTEM_A,
+				X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+				0,
+				CERT_SYSTEM_STORE_CURRENT_USER,
+				(const void*)"ROOT");
 		else
-			store = CertOpenSystemStore(0, "CA");
+			store = CertOpenStore(CERT_STORE_PROV_SYSTEM_A,
+				X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+				0,
+				CERT_SYSTEM_STORE_CURRENT_USER,
+				(const void*)"CA");
 
 		if (store == NULL)
 			return GNUTLS_E_FILE_ERROR;
--- a/lib/system/keys-win.c
+++ b/lib/system/keys-win.c
@@ -41,7 +41,7 @@
 #error should not be included
 #endif
 
-#include <wincrypt.h>
+#include <bcrypt.h>
 #include <winbase.h>
 
 #define DYN_NCRYPT
@@ -647,7 +647,11 @@ int _gnutls_privkey_import_system_url(gnutls_privkey_t pkey, const char *url)
 	blob.cbData = id_size;
 	blob.pbData = id;
 
-	store = CertOpenSystemStore(0, "MY");
+	store = CertOpenStore(CERT_STORE_PROV_SYSTEM_A,
+		X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+		0,
+		CERT_SYSTEM_STORE_CURRENT_USER,
+		(const void*)"MY");
 	if (store == NULL) {
 		gnutls_assert();
 		ret = GNUTLS_E_FILE_ERROR;
@@ -884,7 +888,11 @@ int _gnutls_x509_crt_import_system_url(gnutls_x509_crt_t crt, const char *url)
 	blob.cbData = id_size;
 	blob.pbData = id;
 
-	store = CertOpenSystemStore(0, "MY");
+	store = CertOpenStore(CERT_STORE_PROV_SYSTEM_A,
+		X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+		0,
+		CERT_SYSTEM_STORE_CURRENT_USER,
+		(const void*)"MY");
 	if (store == NULL) {
 		gnutls_assert();
 		ret = GNUTLS_E_FILE_ERROR;
@@ -1132,7 +1140,11 @@ gnutls_system_key_iter_get_info(gnutls_system_key_iter_t * iter,
 		if (*iter == NULL)
 			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
 
-		(*iter)->store = CertOpenSystemStore(0, "MY");
+		(*iter)->store = CertOpenStore(CERT_STORE_PROV_SYSTEM_A,
+			X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+			0,
+			CERT_SYSTEM_STORE_CURRENT_USER,
+			(const void*)"MY");
 		if ((*iter)->store == NULL) {
 			gnutls_free(*iter);
 			*iter = NULL;
@@ -1205,7 +1217,11 @@ int gnutls_system_key_delete(const char *cert_url, const char *key_url)
 	blob.cbData = id_size;
 	blob.pbData = id;
 
-	store = CertOpenSystemStore(0, "MY");
+	store = CertOpenStore(CERT_STORE_PROV_SYSTEM_A,
+		X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+		0,
+		CERT_SYSTEM_STORE_CURRENT_USER,
+		(const void*)"MY");
 	if (store != NULL) {
 		do {
 			cert = CertFindCertificateInStore(store,
@@ -1426,7 +1442,7 @@ int _gnutls_system_key_init(void)
 	int ret;
 
 #ifdef DYN_NCRYPT
-	ncrypt_lib = LoadLibraryA("ncrypt.dll");
+	ncrypt_lib = LoadPackagedLibrary("ncrypt.dll", 0);
 	if (ncrypt_lib == NULL) {
 		return gnutls_assert_val(GNUTLS_E_CRYPTO_INIT_FAILED);
 	}
--- a/lib/x509.c
+++ b/lib/x509.c
@@ -49,7 +49,7 @@
 #include "system-keys.h"
 #include "urls.h"
 #ifdef _WIN32
-#include <wincrypt.h>
+#include <bcrypt.h>
 #endif
 
 /*
-- 
2.10.2.windows.1

