Enhancements

• Windows has two ways to handle private key material stored in the Certificate Store. There is the legacy method which stems from ancient history and the "Next-Generation" method (CNG) that was introduced in Windows Server 2008 and Vista. This program uses the legacy method by default, because some old software depends on it. For example, some older versions of Exchange are known to fail if the mail certificate is stored using CNG. Also, certificates stored using CNG cannot be directly exported from the IIS Manager regardless of the "exportable" settting (even though they are exportable in other ways). Those use cases are obviously limited and probably don't outweigh the security and flexibility benefits of using the CNG system for most users, so this release offers a new configuration settting UseNextGenerationCryptoApi to enable it.
• The disk log now always contains full verbose information, which will make it much easier for us to diagnose difficult to reproduce issues for user.
• The PrivatekeyExportable setting was moved from the Security section to the Store.CertificateStore section, because it's only relevant there. Having the setting present at the old location will still work to preserve backwards compatibility, but the default settings.json looks different now.

Bugfixes

• The CSR source plugin was broken in release 2.2.0 (#2324, reported by @wldlkh)
• The GoDaddy validation plugin was broken in release 2.2.1 (#2323, reported by @LeeThompson)
• Using --acl-fullcontrol didn't work for EC private keys.
• Certificates were using CNG by default, but were supposed to use the legacy method for backwards compatibility (#2321, reported by @sunstarjeff)