Build infra flake (Upload test results failed in two node_compat jobs), unrelated to this PR. Re-running.

Code Review

Overview

Fixes a regression from #34383: op_node_load_pfx used p12::PFX::cert_bags/key_bags, which only handle the legacy PKCS#12 PBE algorithms (RC2-40 / 3DES with SHA-1 KDF). Every modern openssl pkcs12 -export invocation emits PBES2 + PBKDF2 + AES-CBC bags, so Deno rejected every standard PFX with ASN1Error: Invalid — while the only shape it did accept (-legacy) was rejected by Node. The fix reimplements the bag walk on top of p12's low-level types and routes encrypted bags through a new decrypt_pfx_blob that dispatches between p12::AlgorithmIdentifier::decrypt_pbe (BMPString password) and pkcs8::pkcs5::EncryptionScheme::decrypt (UTF-8 password) based on the algorithm OID.

Correctness

• Algorithm dispatch is right. PKCS#12 PBE → BMPString password (RFC 7292 §B.1). PBES2 → raw UTF-8 octets (RFC 8018 §6.1.1). The comment in decrypt_pfx_blob calls this out, matching OpenSSL/Node.
• Re-encode-then-parse trick for PBES2. yasna::construct_der(|w| alg.write(w)) followed by pkcs8::pkcs5::EncryptionScheme::from_der(&alg_der) is awkward but works — the two crates have no shared AlgorithmIdentifier type. Functional; minor inefficiency.
• pfx_safe_bags mirrors PFX::bags() — walks the outer SafeContents, then for each ContentInfo either returns inline Data bytes or decrypts the EncryptedData envelope. Standard PKCS#12 layout.
• MAC verify still uses auth_safe.data(&bmp_password) — a separate decryption pass that runs before the new code. In the common case auth_safe is Data (not EncryptedData), so both paths return the inline bytes and there's no duplicated decryption. Edge case: if a PFX has its outer auth_safe wrapped in EncryptedData with PBES2 (uncommon but RFC-allowed), MAC verify fails before this PR's code runs, because p12::auth_safe.data() can't handle PBES2 there either. That case remains broken — uncommon shape, not blocking.
• Error mapping at the shrouded-key-bag site is misleading. decrypt_pfx_blob(...).ok_or(PfxLoadError::NoKey)? returns "no private key found" if PBES2 decryption fails for any reason (wrong passphrase on a modern PFX, unsupported cipher, malformed ciphertext, etc.). A user with a typo'd password would see "no key" instead of a decryption error. Worth changing to an explicit decryption-failure variant.

Security

• Missing iteration-count cap on PBES2/PBKDF2. The existing code added PFX_MAC_ITERATIONS_CAP = 600_000 for the MAC PBKDF on the rationale that PFX bytes are attacker-controlled. PBES2 has the same property: the PBKDF2 iteration count in the EncryptionAlgorithm parameters is attacker-controlled, can be up to ~4B, and pkcs8::pkcs5::EncryptionScheme::decrypt doesn't cap it. A malicious PFX with a 4-billion-iteration PBKDF2 on a cert bag (or many bags) ties up CPU for tens of seconds per call. Same threat model the existing cap was written to defend against. Recommend extracting the PBKDF2 iteration count from the parsed EncryptionScheme and applying the same cap before decrypt. This is the main thing I'd want addressed before merging.

Code quality

• Excellent comments. Each new function explains why it exists, what password encoding applies to which algorithm family, and the relationship to the upstream p12 crate.
• Clean separation. pfx_content_data / decrypt_pfx_blob / pfx_safe_bags decompose cleanly along the layers of PKCS#12 (ContentInfo → SafeContents → SafeBag).
• pbes2_oid() as a function that constructs a new ObjectIdentifier per call is a minor wart — could be LazyLock since it's compared on every bag. Allocation-light; not a hot path. Leave it or polish at will.
• OtherContext(_) rejection in pfx_content_data matches Node behavior. Good.

Test coverage

• New fixture localhost_modern.pfx generated with the standard openssl pkcs12 -export command (documented in tls/README.md). The test exercises PBES2/PBKDF2/AES-256-CBC end-to-end through tls.createSecureContext. Solid regression coverage for tls.createSecureContext({ pfx, passphrase }) rejects every standard openssl pkcs12 -export output with ASN1Error: Invalid (regression after #34383) #34434.
• Existing legacy fixtures (localhost_sha1/256/384/512.pfx) keep coverage of the PKCS#12 PBE path. README updated to reflect the split.
• Gaps:
  • No test for wrong passphrase against the modern PFX — would surface the NoKey-as-decryption-failure error mapping.
  • No test for PBES2 with AES-128 or AES-192 (only AES-256, since that's the OpenSSL 3 default). EncryptionScheme handles them uniformly, so risk is low, but a parametrized test would close the gap cheaply.
  • No DoS test for high PBKDF2 iteration counts (related to the security note above).

Risk

• Medium-low. Reimplementing the bag walk touches the critical path for every pfx load, but legacy PBE still routes through p12::AlgorithmIdentifier::decrypt_pbe unchanged. Main risks are the PBKDF2 iteration DoS and the misleading NoKey error.

Suggestions (in priority order)

1. Cap the PBES2/PBKDF2 iteration count before calling EncryptionScheme::decrypt, mirroring PFX_MAC_ITERATIONS_CAP. The threat model (attacker-controlled PFX bytes) is identical.
2. Fix the misleading error mapping at the shrouded key bag site — return an explicit decryption error rather than PfxLoadError::NoKey when decrypt_pfx_blob returns None. Add a test for wrong passphrase against localhost_modern.pfx.
3. (Nice-to-have) Add a fixture or two for PBES2 with AES-128 / AES-192 to round out cipher coverage.
4. (Style) Consider LazyLock for pbes2_oid() — minor.

Overall: well-scoped fix with strong analysis and good test coverage of the happy path. The PBES2 iteration cap is the one substantive concern; the error mapping is a small but user-visible issue. Both are easy to address.