title: getting the server's certificate when InitializeSecurityContext fails with SEC_E_WRONG_PRINCIPAL
body: <p>InitializeSecurityContext (Schannel) fails with SEC_E_WRONG_PRINCIPAL when none of the names on the server's supplied certificate match the pszTargetName parameter, which is the name of the server, essentially.</p>
  <p>If you have a fully formed security context, you can get the server's certificate with a call to QueryContextAttributes for SECPKG_ATTR_REMOTE_CERT_CONTEXT. The call to QueryContextAttributes fails with SEC_E_INVALID_HANDLE if the partly formed security context from the failing InitializeSecurityContext negotiation is used as the phContext parameter.</p>
  <p>In this case, is there a way for the client side to get access to the certificate the server sent so we can report the names on the certificate?</p>
  <p>NB. If we <em>really really</em> wanted to, we could probably redo the negotiation, specifying ISC_REQ_MANUAL_CRED_VALIDATION, and then call QueryContextAttributes on <em>that</em> security context (and then immediately destroy it), but this seems stupid.</p>