WinInet error 12157 and Client certificate

The documentation for this error is sparce... the 'standard' error list ends at 12156  The defined constant name in wininet.h is:

     ERROR_INTERNET_SECURITY_CHANNEL_ERROR
with text like:
     "The application experienced an internal error loading the SSL libraries."

My software must present a client certificate to the host.  It does that by

1) opening a cert store via ::CertOpenStore(),
2) obtaining the cert via ::CertEnumCertificatesInStore()
3) Establish a connection via CInternetSession::GetHttpConnection
4) Opening a request via CHttpConnection::OpenRequest()
5) Noting the expected  error response ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED (12044)
6) Using InternetSetOption(...,INTERNET_OPTION_CLIENT_CERT_CONTEXT,...) to provide the cert context
7) CHttpFile::SendRequest() to make the request.

This technique works on all systems where I've been able to test it, but it fails every time for one of my customers.  The 12157 exception occurs in step 7 above (he is runnign Win2000 Pro, SP4).

In the one case where I saw this error myself, it was on a computer running weak encryption.  I upgraded IE to version 6 and the errors immediately stopped.  But my customer says that he has upgraded to the latest Win2K service packs and the latest version of IE.

One other note:  
The Internet host to which I an connecting provides a way to manual verify the certificate... you enter the host URL in the address bar and IE6 brings up the "ErrorDlg" that prompts for a cert.  You select it (it is the only one there) and when you OK the dlg, up comes an HTTPS page indicating success.  My customer claims that this test works on his computer, but my programatic method fails.

I'm out of ideas here.  Has anyone seen this 12157 error?  Has anyone worked with client certificates?  I could really use some help!

-- Dan