Certenroll vs Xenroll :
http://msdn.microsoft.com/en-us/library/bb931379(VS.85).aspx

Xenroll attempted to implement two parallel sets of interfaces.
– ICEnroll[X] : Automation-compliant [] compatible with scripting languages.
– IEnroll[X] : could not be scripted [] more convenient for C++ programmers.
[] the two sets [] did not remain synchronized. [] ICEnroll4 defines only a subset of the functionality defined by IEnroll4.
CertEnroll.dll implements a larger and more structured set of Automation-compliant COM interfaces

ICEnroll4::enumContainers Method :
http://msdn.microsoft.com/en-us/library/aa382855(VS.85).aspx

enumProvidersWStr
The enumProvidersWStr function in Xenroll.dll retrieves a cryptographic provider from the collection by index.
http://msdn.microsoft.com/en-us/library/bb545675(VS.85).aspx#enumproviderswstr
When using CertEnroll.dll, you can perform the following actions to retrieve the collection of cryptographic containers:
1. Call the Request property on an existing IX509Enrollment object.
2. Call the GetInnerRequest method on the request returned from step 1 to retrieve the innermost request.
3. Call QueryInterface on the IX509CertificateRequest object returned from step 2 to cast to an IX509CertificateRequestPkcs10 object.
4. Call the PrivateKey property on the PKCS #10 request.
5. Call the CspInformations property on the IX509PrivateKey object retrieved from step 4.

http://msdn.microsoft.com/en-us/library/aa378966(VS.85).aspx

Au passage lien vers CAPI NG (currently supported on Windows Server 2008 and Windows Vista) :
http://msdn.microsoft.com/en-us/library/aa376210(VS.85).aspx