So I've been using MSCAPI and CAPICOM here at work, and I have to say that I'm impressed. I've used OpenSSL for crypto stuff in the past, and both the API and documentation for OpenSSL suck ass. Specifically, the API is counter-intuitive, and the documentation is terse or non-existent. Of course, there are other options, but they're not as popular (and they lack language bindings, at least for the time being).