+1  A: 

Duncan-- Per the WinHTTP team, this was a behavioral change introduced in Windows 7. At present, there is no workaround for this issue in WinHTTP.

EricLaw -MSFT-
Thanks greatly. Thought I was going crazy for a while :-)
Duncan Bayne
Eric, since I posted this question we have had to re-engineer our software to use HTTP rather than HTTPS, because we are being rejected by filtering proxies in corporate networks that filter on the basis of User-Agent. If you're in touch with them, please let the WinHTTP team know that this has been a right pain in the a** for us, and the sooner they get this regression (sorry, behavioural change) fixed the better for all Windows developers.
Duncan Bayne
Duncan: You should contact Microsoft support (http://support.microsoft.com) and get a case filed for this; that's the path to getting a fix released by Microsoft. As this was a change in our behavior, the support charges should be waived.
EricLaw -MSFT-
Eric: I tried calling Microsoft in Australia (13-16-30) and was told by a rude, overbearing CSR that it would cost hundreds of dollars to file a report, that there was no way the charge would be waived, and that his supervisor would say the same thing if I spoke to him. All in all, that's not how I'd expect to be treated when spending my own time to help by reporting a defect for which I've already found a work-around.
Duncan Bayne
Eric: the workaround was, sadly, to provide the option of disabling HTTPS in our comms layer and rely on our existing PKI tamper-proofing functionality. That enables customers who wish to operate over HTTPS from behind proxies that filter on user agents.
Duncan Bayne
Duncan Bayne