diff --git a/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/Interop.crypt32.cs b/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/Interop.crypt32.cs
index 92cd68f0c03ab2..2b59f383266d22 100644
--- a/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/Interop.crypt32.cs
+++ b/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/Interop.crypt32.cs
@@ -150,18 +150,32 @@ public static SafeCertStoreHandle CertOpenStore(CertStoreProvider lpszStoreProvi
         /// the next certificate in the iteration. The final call sets pCertContext to an invalid SafeCertStoreHandle
         /// and returns "false" to indicate the end of the store has been reached.
         /// </summary>
-        public static bool CertEnumCertificatesInStore(SafeCertStoreHandle hCertStore, [NotNull] ref SafeCertContextHandle? pCertContext)
+        public static unsafe bool CertEnumCertificatesInStore(SafeCertStoreHandle hCertStore, [NotNull] ref SafeCertContextHandle? pCertContext)
         {
-            unsafe
+            CERT_CONTEXT* pPrevCertContext;
+            if (pCertContext == null)
             {
-                CERT_CONTEXT* pPrevCertContext = pCertContext == null ? null : pCertContext.Disconnect();
-                pCertContext = CertEnumCertificatesInStore(hCertStore, pPrevCertContext);
-                return !pCertContext.IsInvalid;
+                pCertContext = new SafeCertContextHandle();
+                pPrevCertContext = null;
             }
+            else
+            {
+                pPrevCertContext = pCertContext.Disconnect();
+            }
+
+            pCertContext.SetHandle((IntPtr)CertEnumCertificatesInStore(hCertStore, pPrevCertContext));
+
+            if (!pCertContext.IsInvalid)
+            {
+                return true;
+            }
+
+            pCertContext.Dispose();
+            return false;
         }
 
         [DllImport(Libraries.Crypt32, CharSet = CharSet.Unicode, SetLastError = true)]
-        private static extern unsafe SafeCertContextHandle CertEnumCertificatesInStore(SafeCertStoreHandle hCertStore, CERT_CONTEXT* pPrevCertContext);
+        private static extern unsafe CERT_CONTEXT* CertEnumCertificatesInStore(SafeCertStoreHandle hCertStore, CERT_CONTEXT* pPrevCertContext);
 
         [DllImport(Libraries.Crypt32, CharSet = CharSet.Unicode, SetLastError = true)]
         public static extern SafeCertStoreHandle PFXImportCertStore([In] ref CRYPTOAPI_BLOB pPFX, SafePasswordHandle password, PfxCertStoreFlags dwFlags);
diff --git a/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/SafeHandles.cs b/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/SafeHandles.cs
index 4643f6fa211cc9..4c3ba2011b679f 100644
--- a/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/SafeHandles.cs
+++ b/src/libraries/System.Security.Cryptography.X509Certificates/src/Internal/Cryptography/Pal.Windows/Native/SafeHandles.cs
@@ -62,6 +62,8 @@ public SafeCertContextHandle(SafeCertContextHandle parent)
             SetHandle(_parent.handle);
         }
 
+        internal new void SetHandle(IntPtr handle) => base.SetHandle(handle);
+
         protected override bool ReleaseHandle()
         {
             if (_parent != null)