SSPI Overview and Steps
 
SSPI stands for Security Support Provider Interface. It is an abstraction layer over the security services provided by windows. SSL/TLS itself is implemented in Secure Channel security provider and SSPI abstracts it for us. SSPI works by taking and returning data blobs to be sent to remote party. This way it allows us most flexibility in choosing what protocol (for ex., tcp/ip) to use and what to do with encrypted/decrypted data. One thing to be aware of is making sure the data is a stream and nothing is out of sequence. SSPI provides a number of built-in protocols Kerberos, NTLM, SSL/TLS. There is almost exactly the same sequence of function calls for either of them. In SSL/TLS case there is a little more to be done.
 
Client Side:
1) Open Certificate store. Choose what certificate to use. Call AcquireCredentialsHandle.
2) When you need to connect. Call InitializeSecurityContext. Send out data blob that is returned.
3) Go into handshake loop with remote party by calling InitializeSecurityContext passing in received data blobs and sending out returned data blobs until success is returned.
4) When need to send data out, call EncryptMessage and send returned encrypted data blob to remote party.
5) When need to decrypt received data, call DecryptMessage and process decrypted data blob
6) When done, call ApplyControlToken with SCHANNEL_SHUTDOWN. Call InitializeSecurityContext and send out returned data blob.
 
Server Side:
1) Open Certificate store. Choose what certificate to use. Call AcquireCredentialsHandle.
2) When you receive new connection from client, call AcceptSecurityContext. Send out data blob that is returned.
3) Go into handshake loop with remote party by calling AcceptSecurityContext passing in received data blobs and sending out returned data blobs until success is returned.
4) When need to send data out, call EncryptMessage and send returned encrypted data blob to remote party.
5) When need to decrypt received data, call DecryptMessage and process decrypted data blob
6) When done, call ApplyControlToken with SCHANNEL_SHUTDOWN. Call AcceptSecurityContext and send out returned data blob.

initialisation des sockets, BIO, contexte ssl, etc
...
char* request = "voici ma requete a envoyer";
request_len = strlen(request);
SSL_write(ssl, request, request_len);

initialisation des sockets, contexte ssl, etc
SecBufferDesc   Message; // initialisation des buffers à envoyer
...
scRet = g_pSSPI->EncryptMessage(phContext, 0, &Message, 0); // encryption du message
send(Socket, ...); // envoi du message crypté de la manière qu'on veut