From 73cd4f1dde7d5d713b76873cbd745d8ec67762cc Mon Sep 17 00:00:00 2001
From: Brian Muenzenmeyer <brian.muenzenmeyer@gmail.com>
Date: Fri, 28 Aug 2026 06:10:13 -0500
Subject: [PATCH] crypto: add crypto.parsePKCS12()

Return the private key, end-entity certificate, and any other
non-matching certificates from a PKCS#12 (.p12/.pfx) bundle as a
KeyObject and X509Certificate instances.

Node.js already parses PKCS#12 in SecureContext::LoadPKCS12, which backs
tls's `pfx` option, but the results are consumed directly into an
SSL_CTX and never reach JavaScript. Callers who need the key or the
certificates for anything other than an immediate TLS connection have to
shell out to `openssl pkcs12` or take a userland dependency.

The binding wraps d2i_PKCS12_bio() and PKCS12_parse() and follows their
semantics, matching the existing TLS path: the first private key is
returned, the end-entity certificate is the one associated with that
key, and any remaining certificates are returned through
`additionalCertificates`. A bundle containing no private key reports
`certificate` as null and returns its certificates through
`additionalCertificates`.

Absent and empty passphrases are kept distinct, since OpenSSL treats
them differently. Bundles that require OpenSSL's legacy provider throw
ERR_CRYPTO_UNSUPPORTED_OPERATION, reusing the error added for the TLS
path.

Signed-off-by: bmuenzenmeyer <brian.muenzenmeyer@gmail.com>
---
 doc/api/crypto.md                            |  63 ++++++
 lib/crypto.js                                |   2 +
 lib/internal/crypto/keys.js                  |  66 ++++++
 node.gyp                                     |   2 +
 src/crypto/crypto_pkcs12.cc                  | 220 ++++++++++++++++++
 src/crypto/crypto_pkcs12.h                   |  23 ++
 src/node_crypto.cc                           |   1 +
 src/node_crypto.h                            |   1 +
 test/fixtures/keys/Makefile                  |  13 ++
 test/fixtures/keys/cert-without-key-fips.pfx | Bin 0 -> 1296 bytes
 test/parallel/test-crypto-pkcs12.js          | 226 +++++++++++++++++++
 typings/internalBinding/crypto.d.ts          |  10 +
 12 files changed, 627 insertions(+)
 create mode 100644 src/crypto/crypto_pkcs12.cc
 create mode 100644 src/crypto/crypto_pkcs12.h
 create mode 100644 test/fixtures/keys/cert-without-key-fips.pfx
 create mode 100644 test/parallel/test-crypto-pkcs12.js

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index a08519a5768..e60e31e7909 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -5516,6 +5516,65 @@ const derivedKey = hkdfSync('sha512', 'key', 'salt', 'info', 64);
 console.log(Buffer.from(derivedKey).toString('hex'));  // '24156e2...5391653'
 ```
 
+### `crypto.parsePKCS12(bundle[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `bundle` {ArrayBuffer|Buffer|TypedArray|DataView} The DER-encoded PKCS#12
+  bundle.
+* `options` {Object}
+  * `passphrase` {string|ArrayBuffer|Buffer|TypedArray|DataView} The passphrase
+    protecting the bundle. Omit for bundles with no passphrase. PKCS#12
+    encodes an absent and an empty passphrase differently, but OpenSSL tries
+    both, so omitting this option and passing `''` behave the same. The
+    passphrase must not contain a NUL byte; PKCS#12 passwords cannot
+    represent one, and passing one throws [`ERR_INVALID_ARG_VALUE`][].
+* Returns: {Object}
+  * `privateKey` {KeyObject|null} The private key, or `null` if the bundle
+    contains none.
+  * `certificate` {X509Certificate|null} The certificate associated with
+    `privateKey`, or `null` if the bundle contains none.
+  * `additionalCertificates` {X509Certificate\[]} Every other certificate in
+    the bundle. These are not necessarily certificate authorities; this is
+    whatever remains once `certificate` has been taken out. May be empty.
+
+Parses a PKCS#12 bundle — commonly seen with the `.p12` or `.pfx` extension —
+and returns its contents.
+
+```mjs
+import { parsePKCS12 } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+
+const { privateKey, certificate } = parsePKCS12(
+  readFileSync('bundle.p12'),
+  { passphrase: 'secret' },
+);
+
+console.log(certificate.subject);
+console.log(privateKey.export({ type: 'pkcs8', format: 'pem' }));
+```
+
+A PKCS#12 bundle may technically contain more than one private key. This API
+returns only the first, matching the behavior of OpenSSL's `PKCS12_parse()`.
+
+`certificate` is identified by its association with the private key. A bundle
+containing no private key therefore reports `certificate` as `null` and returns
+all of its certificates through `additionalCertificates`, including any
+end-entity certificate the bundle holds.
+
+Bundles encrypted with older algorithms — notably RC2 and PBE-SHA1 variants
+produced by legacy Windows tooling and older versions of `keytool` — require
+OpenSSL's legacy provider. Reading these throws an error with the code
+[`ERR_CRYPTO_UNSUPPORTED_OPERATION`][]; starting Node.js with
+[`--openssl-legacy-provider`][] may allow them to be read, subject to the
+security implications of enabling that provider.
+
+To use a PKCS#12 bundle directly for a TLS connection, prefer the `pfx` option
+of [`tls.createSecureContext()`][] rather than parsing and re-supplying the
+parts.
+
 ### `crypto.pbkdf2(password, salt, iterations, keylen, digest, callback)`
 
 <!-- YAML
@@ -7624,11 +7683,14 @@ See the [list of SSL OP Flags][] for details.
 [`--enable-fips`]: cli.md#--enable-fips
 [`--force-fips`]: cli.md#--force-fips
 [`--openssl-config`]: cli.md#--openssl-configfile
+[`--openssl-legacy-provider`]: cli.md#--openssl-legacy-provider
 [`--openssl-shared-config`]: cli.md#--openssl-shared-config
 [`BN_is_prime_ex`]: https://www.openssl.org/docs/man1.1.1/man3/BN_is_prime_ex.html
 [`Buffer`]: buffer.md
 [`DH_generate_key()`]: https://www.openssl.org/docs/man3.0/man3/DH_generate_key.html
 [`DiffieHellmanGroup`]: #class-diffiehellmangroup
+[`ERR_CRYPTO_UNSUPPORTED_OPERATION`]: errors.md#err_crypto_unsupported_operation
+[`ERR_INVALID_ARG_VALUE`]: errors.md#err_invalid_arg_value
 [`KeyObject`]: #class-keyobject
 [`Sign`]: #class-sign
 [`String.prototype.normalize()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
@@ -7690,6 +7752,7 @@ See the [list of SSL OP Flags][] for details.
 [`stream.Transform`]: stream.md#class-streamtransform
 [`stream.Writable` options]: stream.md#new-streamwritableoptions
 [`stream.transform` options]: stream.md#new-streamtransformoptions
+[`tls.createSecureContext()`]: tls.md#tlscreatesecurecontextoptions
 [`util.promisify()`]: util.md#utilpromisifyoriginal
 [`verify.update()`]: #verifyupdatedata-inputencoding
 [`verify.verify()`]: #verifyverifykey-signature-signatureencoding
diff --git a/lib/crypto.js b/lib/crypto.js
index b44ae9de4e5..3e720cd3bdf 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -84,6 +84,7 @@ const {
   createSecretKey,
   createPublicKey,
   createPrivateKey,
+  parsePKCS12,
   KeyObject,
 } = require('internal/crypto/keys');
 const {
@@ -216,6 +217,7 @@ module.exports = {
   getMacs,
   hkdf,
   hkdfSync,
+  parsePKCS12,
   pbkdf2,
   pbkdf2Sync,
   generateKeyPair,
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 1623825b527..946c8902696 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  ArrayPrototypeMap,
   ArrayPrototypeSlice,
   ObjectDefineProperties,
   ObjectPrototypeHasOwnProperty,
@@ -8,6 +9,7 @@ const {
   StringPrototypeIncludes,
   StringPrototypeStartsWith,
   SymbolToStringTag,
+  TypedArrayPrototypeIncludes,
   Uint8Array,
 } = primordials;
 
@@ -35,6 +37,7 @@ const {
   kKeyEncodingPKCS8,
   kKeyEncodingSPKI,
   kKeyEncodingSEC1,
+  parsePKCS12: _parsePKCS12,
 } = internalBinding('crypto');
 
 const {
@@ -63,6 +66,7 @@ const {
 
 const {
   getArrayBufferOrView,
+  getBufferSourceBytes,
   bigIntArrayToUnsignedBigInt,
   normalizeAlgorithm,
   hasAnyNotIn,
@@ -77,6 +81,8 @@ const {
   isArrayBufferView,
 } = require('internal/util/types');
 
+const { Buffer } = require('buffer');
+
 const {
   fileURLToPath,
   getURLHref,
@@ -757,6 +763,65 @@ function createPublicKey(key) {
   return new PublicKeyObject(handle);
 }
 
+/**
+ * Parses a PKCS#12 (.p12 / .pfx) bundle. Returns an object holding the first
+ * private key as `privateKey`, the certificate associated with it as
+ * `certificate`, and every other certificate in the bundle as an array in
+ * `additionalCertificates`. `privateKey` and `certificate` are null when the
+ * bundle contains none.
+ * @param {ArrayBuffer|Buffer|TypedArray|DataView} bundle
+ * @param {object} [options]
+ * @returns {object}
+ */
+function parsePKCS12(bundle, options = kEmptyObject) {
+  if (!isArrayBufferView(bundle) && !isAnyArrayBuffer(bundle)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'bundle',
+      ['ArrayBuffer', 'TypedArray', 'DataView', 'Buffer'],
+      bundle);
+  }
+
+  validateObject(options, 'options');
+  const { passphrase } = options;
+
+  // `undefined` means no passphrase, '' a zero-length one. OpenSSL accepts
+  // either PKCS#12 password encoding for both, so they behave the same.
+  let passBuf;
+  if (passphrase !== undefined) {
+    passBuf = getArrayBufferOrView(passphrase, 'options.passphrase', 'utf8');
+    // OpenSSL takes the passphrase as a NUL-terminated C string, so one
+    // containing a NUL byte would be truncated there and the bundle opened
+    // with only the bytes before it. A PKCS#12 password cannot represent an
+    // embedded NUL anyway, so reject it outright.
+    if (TypedArrayPrototypeIncludes(getBufferSourceBytes(passBuf), 0)) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.passphrase', passphrase, 'must not contain null bytes');
+    }
+    // The binding reads the passphrase as a view; wrap a bare ArrayBuffer.
+    if (isAnyArrayBuffer(passBuf)) passBuf = Buffer.from(passBuf);
+  }
+
+  // Likewise, the binding reads the bundle as a view.
+  const bundleBuf = isAnyArrayBuffer(bundle) ? Buffer.from(bundle) : bundle;
+
+  const {
+    0: keyHandle,
+    1: certHandle,
+    2: otherHandles,
+  } = _parsePKCS12(bundleBuf, passBuf);
+
+  // Required lazily: internal/crypto/x509 depends on this module.
+  const { InternalX509Certificate } = require('internal/crypto/x509');
+
+  return {
+    privateKey: keyHandle === null ? null : new PrivateKeyObject(keyHandle),
+    certificate:
+      certHandle === null ? null : new InternalX509Certificate(certHandle),
+    additionalCertificates:
+      ArrayPrototypeMap(otherHandles, (h) => new InternalX509Certificate(h)),
+  };
+}
+
 /**
  * Converts a secret KeyObjectHandle to a CryptoKey by dispatching to the
  * algorithm-specific Web Crypto import path.
@@ -1358,6 +1423,7 @@ module.exports = {
   createSecretKey,
   createPublicKey,
   createPrivateKey,
+  parsePKCS12,
   KeyObject,
   CryptoKey,
   InternalCryptoKey,
diff --git a/node.gyp b/node.gyp
index 942bea02449..5da7aec70bf 100644
--- a/node.gyp
+++ b/node.gyp
@@ -409,6 +409,7 @@
       'src/crypto/crypto_hash.cc',
       'src/crypto/crypto_keys.cc',
       'src/crypto/crypto_keygen.cc',
+      'src/crypto/crypto_pkcs12.cc',
       'src/crypto/crypto_scrypt.cc',
       'src/crypto/crypto_tls.cc',
       'src/crypto/crypto_x509.cc',
@@ -429,6 +430,7 @@
       'src/crypto/crypto_hash.h',
       'src/crypto/crypto_keys.h',
       'src/crypto/crypto_keygen.h',
+      'src/crypto/crypto_pkcs12.h',
       'src/crypto/crypto_scrypt.h',
       'src/crypto/crypto_tls.h',
       'src/crypto/crypto_context.h',
diff --git a/src/crypto/crypto_pkcs12.cc b/src/crypto/crypto_pkcs12.cc
new file mode 100644
index 00000000000..28a17a3ef19
--- /dev/null
+++ b/src/crypto/crypto_pkcs12.cc
@@ -0,0 +1,220 @@
+#include "crypto/crypto_pkcs12.h"
+#include "crypto/crypto_context.h"
+#include "crypto/crypto_keys.h"
+#include "crypto/crypto_util.h"
+#include "crypto/crypto_x509.h"
+#include "env-inl.h"
+#include "ncrypto.h"
+#include "node_errors.h"
+#include "util-inl.h"
+#include "v8.h"
+
+#include <openssl/pkcs12.h>
+
+#include <string>
+
+namespace node {
+
+using ncrypto::BIOPointer;
+using v8::Array;
+using v8::ArrayBufferView;
+using v8::FunctionCallbackInfo;
+using v8::Local;
+using v8::LocalVector;
+using v8::Object;
+using v8::Value;
+
+namespace crypto {
+
+namespace {
+
+using PKCS12Pointer = ncrypto::DeleteFnPtr<PKCS12, PKCS12_free>;
+
+// Parsed contents of a PKCS#12 bundle. Any field may be empty: a bundle can
+// legitimately contain only certificates, or only a key.
+struct PKCS12Contents {
+  ncrypto::EVPKeyPointer key;
+  ncrypto::X509Pointer cert;
+  ncrypto::StackOfX509 ca;
+};
+
+enum class PKCS12ParseError {
+  // Input is not a well-formed PKCS#12 structure.
+  NOT_RECOGNIZED,
+  // Structure is valid but uses an algorithm the active providers do not
+  // offer -- typically RC2 or PBE-SHA1 without the legacy provider.
+  UNSUPPORTED_ALGORITHM,
+  FAILED,
+};
+
+using PKCS12ParseResult = ncrypto::Result<PKCS12Contents, PKCS12ParseError>;
+
+// Parses a PKCS#12 bundle from `bio`. `pass` is nullptr for no passphrase, or
+// a NUL-terminated string. PKCS12_parse() verifies the MAC when one is present,
+// and for nullptr or "" it tries both PKCS#12 password encodings, so those two
+// arguments cannot give different results.
+PKCS12ParseResult ParseBundle(const BIOPointer& bio, const char* pass) {
+  ncrypto::ClearErrorOnReturn clear_error_on_return;
+
+  if (!bio) {
+    return PKCS12ParseResult(PKCS12ParseError::FAILED,
+                             static_cast<int>(ERR_get_error()));
+  }
+
+  PKCS12* p12_ptr = nullptr;
+  if (!d2i_PKCS12_bio(bio.get(), &p12_ptr) || p12_ptr == nullptr) {
+    return PKCS12ParseResult(PKCS12ParseError::NOT_RECOGNIZED,
+                             static_cast<int>(ERR_get_error()));
+  }
+  PKCS12Pointer p12(p12_ptr);
+
+  EVP_PKEY* pkey_ptr = nullptr;
+  X509* cert_ptr = nullptr;
+  STACK_OF(X509)* ca_ptr = nullptr;
+
+  if (!PKCS12_parse(p12.get(), pass, &pkey_ptr, &cert_ptr, &ca_ptr)) {
+    unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
+#ifdef OPENSSL_IS_BORINGSSL
+    // BoringSSL's d2i_PKCS12() only copies the input; it does no ASN.1
+    // validation, so malformed input gets this far rather than failing above.
+    // PKCS8_R_BAD_PKCS12_DATA is raised only for structural failures -- a
+    // wrong passphrase is reported as PKCS8_R_INCORRECT_PASSWORD instead --
+    // so it means the same thing the d2i failure does on OpenSSL.
+    if (ERR_GET_LIB(err) == ERR_LIB_PKCS8 &&
+        ERR_GET_REASON(err) == PKCS8_R_BAD_PKCS12_DATA) {
+      return PKCS12ParseResult(PKCS12ParseError::NOT_RECOGNIZED,
+                               static_cast<int>(err));
+    }
+#endif
+#if OPENSSL_VERSION_MAJOR >= 3
+    // Same condition the TLS path checks: OpenSSL 3 reports algorithms that
+    // moved to the legacy provider as a bare "unsupported" error.
+    if (ERR_GET_REASON(err) == ERR_R_UNSUPPORTED) {
+      return PKCS12ParseResult(PKCS12ParseError::UNSUPPORTED_ALGORITHM,
+                               static_cast<int>(err));
+    }
+#endif
+    return PKCS12ParseResult(PKCS12ParseError::FAILED, static_cast<int>(err));
+  }
+
+  PKCS12Contents contents;
+  contents.key.reset(pkey_ptr);
+  contents.cert.reset(cert_ptr);
+  contents.ca.reset(ca_ptr);
+  return PKCS12ParseResult(std::move(contents));
+}
+
+// Returns [ keyHandle | null, certificate | null,
+//           [ ...additionalCertificates ] ].
+void ParsePKCS12(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+
+  CHECK_GE(args.Length(), 2);
+
+  BIOPointer bio(LoadBIO(env, args[0]));
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                             "Unable to read PKCS#12 data");
+  }
+
+  // PKCS12_parse() takes a NUL-terminated C string; a view is not one, so copy
+  // the bytes out.
+  std::string pass_storage;
+  const char* pass = nullptr;
+  if (!args[1]->IsUndefined()) {
+    THROW_AND_RETURN_IF_NOT_BUFFER(env, args[1], "passphrase");
+    Local<ArrayBufferView> abv = args[1].As<ArrayBufferView>();
+    size_t len = abv->ByteLength();
+    pass_storage.resize(len);
+    if (len > 0) abv->CopyContents(pass_storage.data(), len);
+    // PKCS12_parse() has no length parameter, so an embedded NUL byte would
+    // truncate the passphrase and open the bundle with only the bytes that
+    // precede it. Reject it rather than silently accepting a shorter
+    // passphrase than the caller supplied. The JS layer checks this too;
+    // this is the backstop.
+    if (pass_storage.find('\0') != std::string::npos) {
+      return THROW_ERR_INVALID_ARG_VALUE(
+          env, "passphrase must not contain null bytes");
+    }
+    pass = pass_storage.c_str();
+  }
+
+  auto parsed = ParseBundle(bio, pass);
+
+  if (!parsed) {
+    switch (*parsed.error) {
+      case PKCS12ParseError::NOT_RECOGNIZED:
+        return THROW_ERR_CRYPTO_OPERATION_FAILED(
+            env, "Input is not a valid PKCS#12 structure");
+      case PKCS12ParseError::UNSUPPORTED_ALGORITHM:
+        // Same condition PR #54485 addressed for the TLS path: OpenSSL 3
+        // moved RC2 and PBE-SHA1 into the legacy provider.
+        return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+            env,
+            "PKCS#12 bundle uses an unsupported algorithm; it may require "
+            "the OpenSSL legacy provider");
+      case PKCS12ParseError::FAILED:
+        return ThrowCryptoError(env,
+                                parsed.openssl_error.value_or(0),
+                                "Unable to parse PKCS#12 data");
+    }
+  }
+
+  Local<Value> key_value = v8::Null(env->isolate());
+  if (parsed.value.key) {
+    auto data = KeyObjectData::CreateAsymmetric(KeyType::kKeyTypePrivate,
+                                                std::move(parsed.value.key));
+    Local<Object> handle;
+    if (!KeyObjectHandle::Create(env, data).ToLocal(&handle)) return;
+    key_value = handle;
+  }
+
+  Local<Value> cert_value = v8::Null(env->isolate());
+  if (parsed.value.cert) {
+    Local<Object> cert;
+    if (!X509Certificate::New(env, std::move(parsed.value.cert))
+             .ToLocal(&cert)) {
+      return;
+    }
+    cert_value = cert;
+  }
+
+  const int ca_count = parsed.value.ca ? sk_X509_num(parsed.value.ca.get()) : 0;
+  LocalVector<Value> ca_values(env->isolate());
+  ca_values.reserve(ca_count > 0 ? ca_count : 0);
+
+  for (int i = 0; i < ca_count; i++) {
+    X509* ca = sk_X509_value(parsed.value.ca.get(), i);
+    if (ca == nullptr) continue;
+    // New() takes ownership, so hand it a reference of its own rather than
+    // the stack's.
+    X509_up_ref(ca);
+    ncrypto::X509Pointer owned(ca);
+    Local<Object> obj;
+    if (!X509Certificate::New(env, std::move(owned)).ToLocal(&obj)) return;
+    ca_values.push_back(obj);
+  }
+
+  Local<Value> result[] = {
+      key_value,
+      cert_value,
+      Array::New(env->isolate(), ca_values.data(), ca_values.size()),
+  };
+
+  args.GetReturnValue().Set(
+      Array::New(env->isolate(), result, arraysize(result)));
+}
+
+}  // anonymous namespace
+
+void PKCS12Parser::Initialize(Environment* env, Local<Object> target) {
+  SetMethodNoSideEffect(env->context(), target, "parsePKCS12", ParsePKCS12);
+}
+
+void PKCS12Parser::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(ParsePKCS12);
+}
+
+}  // namespace crypto
+}  // namespace node
diff --git a/src/crypto/crypto_pkcs12.h b/src/crypto/crypto_pkcs12.h
new file mode 100644
index 00000000000..e715fcdae10
--- /dev/null
+++ b/src/crypto/crypto_pkcs12.h
@@ -0,0 +1,23 @@
+#ifndef SRC_CRYPTO_CRYPTO_PKCS12_H_
+#define SRC_CRYPTO_CRYPTO_PKCS12_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "env.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+
+class PKCS12Parser final {
+ public:
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_PKCS12_H_
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index e82167b1fb4..99cb556ecd9 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -52,6 +52,7 @@ namespace crypto {
   V(NativeCryptoKey)                                                           \
   V(NativeKeyObject)                                                           \
   V(PBKDF2Job)                                                                 \
+  V(PKCS12Parser)                                                              \
   V(Random)                                                                    \
   V(RSAAlg)                                                                    \
   V(SecureContext)                                                             \
diff --git a/src/node_crypto.h b/src/node_crypto.h
index f3e006e5fee..e15e5958808 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -50,6 +50,7 @@
 #include "crypto/crypto_keys.h"
 #include "crypto/crypto_mac.h"
 #include "crypto/crypto_pbkdf2.h"
+#include "crypto/crypto_pkcs12.h"
 #include "crypto/crypto_pqc.h"
 #include "crypto/crypto_random.h"
 #include "crypto/crypto_rsa.h"
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 3ef61d00aff..91e7f47c87d 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -7,6 +7,7 @@ all: \
   ca4-cert.pem \
   ca5-cert.pem \
   ca6-cert.pem \
+  cert-without-key-fips.pfx \
   agent1-cert.pem \
   agent1-fips.pfx \
   agent1.pfx \
@@ -815,6 +816,18 @@ ec-fips.pfx: ec-cert.pem ec-key.pem
 		-out ec-fips.pfx \
 		-password pass:password
 
+# A bundle of certificates with no private key. See agent1-fips.pfx for why the
+# FIPS fixture uses PBMAC1.
+cert-without-key-fips.pfx: ca1-cert.pem
+	openssl pkcs12 -export \
+		-nokeys \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in ca1-cert.pem \
+		-out cert-without-key-fips.pfx \
+		-password pass:password
+
 dh512.pem:
 	openssl dhparam -out dh512.pem 512
 
diff --git a/test/fixtures/keys/cert-without-key-fips.pfx b/test/fixtures/keys/cert-without-key-fips.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..613dbf1a679886c14cfc93f43636a13687896a32
GIT binary patch
literal 1296
zcmXqLV&!3CWHxAGDP`l-YV&CO&dbQoxS)w8jiret2`C%~#8C(-HlUO@P{^H$kpW0K
zAY>Q~;^7=tUV|V5Lj;${K!ru%tsT!bmA9*7ZDxBOxxXdw6cZB%g8>g42gFt;PF4m3
zSvJmuHV?*BW)?;*7J)U!XDu7Tirc~#`k!VO{@l^f#C*YNDo<JSfoVz{`q_CqGH<NZ
zD5;QB-DT%)I{Uvz{RP4MQqx~W?+r<-32Jrty)3|wHRt`UGh5#&GQAeK`ia@*MD3H~
zS6R02nH=zWLH^`<#XP^<TxUtiKhNK|c4O&d#l4faCA^zA?V~(T)0vo?dlK&Kc8@Gt
zv10irQ73(k?R%%oK7Hu;X8z>f8-g~@K^Oe{BcfO4gy+Q0Z1Qm^zZN=YqW&^lR>@8K
zZ!9@{yuae&?9i7V3uZ(dGkNW{Sck2^Y4W)Z;Sni2eB2JHz5nIUxmWt#OZ%D2bsgS6
ziu{*$;YC7W&;9;uRkIYPysTI9UwL)TuMdxFdV&&n-&pmbXnJ5hd!YD7>G=T@v<fFy
zn@rl%<u&z%1mEQH|LgQ;U;1A%?_WyS`A?@F>Oa42xzTq|jK);+xvxT(ci72nPGtG)
z+n!?m_TI{W5z9iVZ%m)~L(_img0AA`t@R5}tg>dhx&H8y5Ygq@tyh=#bF2P&+?IGk
z+VNkG<DG_A@vi)56r^pl-s<gKRcq#bRyvz|!mha%?6HSK{~TJj|J}y3N;7L0Oih0h
zH~XvPwIgMWv(wv_E|)W8VwTEY!pymSf&ZDKiw&o8yxrdu%MjI{zjVcH=jZZuvOS@1
z?GK+zR!$A~_~dryPR0%ko2Pre7et0^c(}ce_wkDFKVB$>JXE_<_S5gyUH#&!1Rve-
z-|+(6UzT~a<nF%q`Ti?ji-Q8izQUFh3f3*te<M5R?b;(>b<cge_<7NXuU75asb?nZ
zYb=e?IwmP9y<M_H*>AR9Wuw^4g!?VQr#A$uuiyLmkCV)unU&Yn7v-N4HaL3iQ`la%
z1Eys&u6A#-+0UY{7<ZKU0Z*+-EdRfvX&D?f_b#4ny{x3s{a0#Pm)f7nmyd-^Pf)A~
z=1aAE5@=pywaocqvPH*xX>GI3Q?nC~+az4_H_+2;|0ZNB*tPXom7Poi*ZRAQzS;>*
zbvkD_;pWG>xjd8Bn()rQv**Fh7LLVxg?-y&WLz(8xf#}dS$oyalxg*c(%W>7{thqw
z_~fB(h{@bZ8u}Th^yW@b+EQeHu=n2@tJuDHmCI2RYgYEu8}>e1@$;t1y9#qRxld~@
z=r^t|(@wl}w$P$Hd%@l*r&Ure_4@qVtd&>##r@}w>j&>LU4QY)ocV}3r{~^Dli81E
z<@s9sdc2G=ezmxuYK!o+RmP8}H6}kX+xcP*PY;*Oymd`C1P?E`7<usY{>iT!&Rof<
zZz)SK+|PJOWaf2_{V#<4cHCa?c)clhVaax;)U?C1BG)aJ^;L@dBPTp>MX$oD2W4i9
zoo-zHWiWH&za`b)b2f(E^vz&aI@}-Gcg-`;pt0AW)F2R1RPY(N7?>cqJO=740s_4I
zOFLgSR+j!O<yn*O#0n}om>3n%3J;W`ghj#ZY}*q45a|iFflObot#>fEaHDyS+>1_U
PU2Byu&yxerVmB55_&ZPG

literal 0
HcmV?d00001

diff --git a/test/parallel/test-crypto-pkcs12.js b/test/parallel/test-crypto-pkcs12.js
new file mode 100644
index 00000000000..0ec9a2f544d
--- /dev/null
+++ b/test/parallel/test-crypto-pkcs12.js
@@ -0,0 +1,226 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fixtures = require('../common/fixtures');
+const { hasOpenSSL3, hasFIPS } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
+
+if (fips3) {
+  // The long-standing fixtures protect their contents with PKCS12KDF and
+  // 3DES, neither of which the FIPS provider offers, so they cannot be opened
+  // at all. Assert the recognizable error rather than skipping: this is the
+  // same path the legacy.pfx case below exercises.
+  for (const name of ['rsa_cert.pfx', 'agent1.pfx']) {
+    assert.throws(
+      () => crypto.parsePKCS12(fixtures.readKey(name), { passphrase: 'sample' }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+
+  // Reading the PBMAC1-protected FIPS fixtures needs OpenSSL 3.5 or newer, so
+  // below that there is nothing further this test can check.
+  if (!hasFIPS(3, 5)) return;
+}
+
+// The FIPS fixtures use PBMAC1/PBKDF2 and AES-256 in place of PKCS12KDF and
+// 3DES. Their passphrase is eight characters because the OpenSSL 4 FIPS
+// provider rejects shorter ones outright, which would mask the errors the
+// cases below are actually about.
+const keyAndCert = fips3 ?
+  { name: 'agent1-fips.pfx', passphrase: 'password', additional: 1 } :
+  { name: 'rsa_cert.pfx', passphrase: 'sample', additional: 0 };
+const withCaCert = fips3 ?
+  { name: 'agent1-fips.pfx', passphrase: 'password' } :
+  { name: 'agent1.pfx', passphrase: 'sample' };
+const ecKeyAndCert = fips3 ?
+  { name: 'ec-fips.pfx', passphrase: 'password' } :
+  { name: 'ec.pfx', passphrase: '' };
+const certWithoutKey = fips3 ?
+  { name: 'cert-without-key-fips.pfx', passphrase: 'password' } :
+  { name: 'cert-without-key.pfx', passphrase: 'test' };
+
+{
+  // Round-trip: a bundle holding one key and its certificate.
+  const bundle = fixtures.readKey(keyAndCert.name);
+  const { privateKey, certificate, additionalCertificates } =
+    crypto.parsePKCS12(bundle, { passphrase: keyAndCert.passphrase });
+
+  assert.strictEqual(privateKey.type, 'private');
+  assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
+  assert.ok(certificate instanceof crypto.X509Certificate);
+  assert.ok(Array.isArray(additionalCertificates));
+  assert.strictEqual(additionalCertificates.length, keyAndCert.additional);
+
+  // The parsed key and certificate must actually correspond.
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+
+  // PEM export -- the primary reason callers want this API at all.
+  const keyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  assert.match(keyPem, /^-----BEGIN PRIVATE KEY-----/);
+  assert.match(certificate.toString(), /^-----BEGIN CERTIFICATE-----/);
+
+  // Round-trips back through createPrivateKey.
+  const reimported = crypto.createPrivateKey(keyPem);
+  assert.strictEqual(reimported.asymmetricKeyType, 'rsa');
+
+  // Passphrase accepted as a buffer as well as a string.
+  const { privateKey: key2 } = crypto.parsePKCS12(
+    bundle, { passphrase: Buffer.from(keyAndCert.passphrase) });
+  assert.strictEqual(key2.type, 'private');
+}
+
+{
+  // A bundle carrying a second certificate alongside the end-entity one.
+  const bundle = fixtures.readKey(withCaCert.name);
+  const { privateKey, certificate, additionalCertificates } =
+    crypto.parsePKCS12(bundle, { passphrase: withCaCert.passphrase });
+  assert.strictEqual(privateKey.type, 'private');
+  assert.ok(certificate instanceof crypto.X509Certificate);
+  assert.strictEqual(additionalCertificates.length, 1);
+  assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+}
+
+{
+  // EC key.
+  const bundle = fixtures.readKey(ecKeyAndCert.name);
+  const { privateKey, certificate } =
+    crypto.parsePKCS12(bundle, { passphrase: ecKeyAndCert.passphrase });
+  assert.strictEqual(privateKey.asymmetricKeyType, 'ec');
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+}
+
+if (!fips3) {
+  // ec.pfx carries an empty passphrase, which the FIPS provider will not
+  // accept at all, so this case has no FIPS counterpart. Omitting the
+  // passphrase rather than passing it empty must behave identically: OpenSSL
+  // tries both PKCS#12 password encodings, so either variant opens the file.
+  const { privateKey } = crypto.parsePKCS12(fixtures.readKey('ec.pfx'));
+  assert.strictEqual(privateKey.asymmetricKeyType, 'ec');
+}
+
+{
+  // Wrong passphrase must be distinguishable from malformed input: OpenSSL
+  // reports it as a MAC verification failure of its own, and BoringSSL
+  // reports the same condition as an incorrect password. It is deliberately
+  // longer than the FIPS minimum password length so that this checks what it
+  // says it does under FIPS too.
+  const code = process.features.openssl_is_boringssl ?
+    'ERR_OSSL_INCORRECT_PASSWORD' : 'ERR_OSSL_PKCS12_MAC_VERIFY_FAILURE';
+  const bundle = fixtures.readKey(keyAndCert.name);
+  assert.throws(
+    () => crypto.parsePKCS12(bundle, { passphrase: 'wrongpassphrase' }),
+    { code });
+}
+
+{
+  // Not a PKCS#12 structure at all. The error must be the same on either
+  // crypto library: OpenSSL rejects this in d2i_PKCS12_bio(), while
+  // BoringSSL's only copies the bytes and leaves every structural check to
+  // PKCS12_parse(), so the binding has to recognize both.
+  assert.throws(
+    () => crypto.parsePKCS12(Buffer.from('not a bundle'), { passphrase: 'x' }),
+    { code: 'ERR_CRYPTO_OPERATION_FAILED', message: /not a valid PKCS#12/ });
+}
+
+{
+  // A bundle with no private key. PKCS12_parse() identifies the end-entity
+  // certificate by its association with the key, so with no key there is
+  // nothing to single out and everything arrives through
+  // `additionalCertificates` -- including the end-entity certificate itself.
+  const bundle = fixtures.readKey(certWithoutKey.name);
+  const { privateKey, certificate, additionalCertificates } =
+    crypto.parsePKCS12(bundle, { passphrase: certWithoutKey.passphrase });
+  assert.strictEqual(privateKey, null);
+  assert.strictEqual(certificate, null);
+  assert.strictEqual(additionalCertificates.length, 1);
+  assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
+}
+
+if (hasOpenSSL3) {
+  // Legacy algorithms (RC2-40-CBC) throw a recognizable, actionable error
+  // rather than a bare OpenSSL string. Mirrors the behavior added for the
+  // TLS path in https://github.com/nodejs/node/pull/54485.
+  const bundle = fixtures.readKey('legacy.pfx');
+  assert.throws(
+    () => crypto.parsePKCS12(bundle, { passphrase: 'legacy' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+}
+
+{
+  // ArrayBuffer is a documented input type for both the bundle and the
+  // passphrase, and must behave the same as a view over the same bytes.
+  const buf = fixtures.readKey(keyAndCert.name);
+  const bundleAb =
+    buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  const passBuf = Buffer.from(keyAndCert.passphrase);
+  const passAb =
+    passBuf.buffer.slice(passBuf.byteOffset,
+                         passBuf.byteOffset + passBuf.byteLength);
+
+  const { privateKey, certificate } =
+    crypto.parsePKCS12(bundleAb, { passphrase: passAb });
+  assert.strictEqual(privateKey.type, 'private');
+  assert.ok(certificate instanceof crypto.X509Certificate);
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+
+  // DataView too.
+  const { privateKey: key2 } = crypto.parsePKCS12(
+    new DataView(bundleAb), { passphrase: keyAndCert.passphrase });
+  assert.strictEqual(key2.type, 'private');
+}
+
+{
+  // A passphrase reaches OpenSSL as a NUL-terminated C string, and
+  // PKCS12_parse() takes no length alongside it. Without a check, everything
+  // from an embedded NUL onwards is dropped and the bundle opens under the
+  // truncated prefix -- a passphrase of '<pass>\0junk' would unlock a bundle
+  // protected by '<pass>'. Reject the passphrase instead, whatever form it
+  // arrives in.
+  const bundle = fixtures.readKey(keyAndCert.name);
+  const withNul = `${keyAndCert.passphrase}\u0000junk`;
+  const withNulBuf = Buffer.from(withNul);
+  const withNulAb = withNulBuf.buffer.slice(
+    withNulBuf.byteOffset, withNulBuf.byteOffset + withNulBuf.byteLength);
+
+  const passphrases = [
+    withNul,
+    withNulBuf,
+    withNulAb,
+    new DataView(withNulAb),
+    new Uint8Array(withNulAb),
+    // A trailing NUL is no more representable than an interior one.
+    `${keyAndCert.passphrase}\u0000`,
+    // And neither is a passphrase that is nothing but a NUL, which must not
+    // be mistaken for the empty passphrase.
+    '\u0000',
+    Buffer.from([0]),
+  ];
+
+  for (const passphrase of passphrases) {
+    assert.throws(
+      () => crypto.parsePKCS12(bundle, { passphrase }),
+      {
+        code: 'ERR_INVALID_ARG_VALUE',
+        message: /options\.passphrase.*must not contain null bytes/,
+      });
+  }
+
+  // The prefix on its own still opens the bundle, which is precisely why the
+  // truncation had to be rejected rather than tolerated.
+  assert.strictEqual(
+    crypto.parsePKCS12(bundle, { passphrase: keyAndCert.passphrase })
+      .privateKey.type,
+    'private');
+}
+
+{
+  // Argument validation.
+  assert.throws(() => crypto.parsePKCS12('a string'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => crypto.parsePKCS12(Buffer.alloc(0), 'nope'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index eb40d33c513..1b19e39e0ad 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -781,6 +781,12 @@ declare namespace InternalCryptoBinding {
       InternalX509Certificate: InternalX509CertificateConstructor,
     ];
 
+  type PKCS12ParseResult = [
+    privateKey: KeyObjectHandle | null,
+    certificate: X509CertificateHandle | null,
+    additionalCertificates: X509CertificateHandle[],
+  ];
+
   interface CipherInfo {
     name: string;
     nid: number;
@@ -1014,6 +1020,10 @@ export interface CryptoBinding {
     functionName?: InternalCryptoBinding.OptionalBufferSource,
     customization?: InternalCryptoBinding.OptionalBufferSource,
   ): string | InternalCryptoBinding.Buffer;
+  parsePKCS12(
+    bundle: InternalCryptoBinding.ByteSource,
+    passphrase?: InternalCryptoBinding.ByteSource,
+  ): InternalCryptoBinding.PKCS12ParseResult;
   parseX509(data: InternalCryptoBinding.ByteSource): InternalCryptoBinding.X509CertificateHandle;
   privateDecrypt: InternalCryptoBinding.PublicKeyCipher;
   privateEncrypt: InternalCryptoBinding.PublicKeyCipher;