[azidentity] pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1

[DariuszPorowski]

Bug Report

• import path of package: github.com/Azure/azure-sdk-for-go/sdk/azidentity
• SDK version: 1.5.2
• output of go version go1.22.3 windows/amd64

• What happened?

During the usage of cert, key, err := azidentity.ParseCertificates(certData, password) I got error like: pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1

• What did you expect or want to happen?

cert bytes are parsed

• How can we reproduce it?

try to parse cert with sha256 hashing

• Anything we should know about your environment.

[chlowell]

Thanks for opening this issue! You're seeing this error because ParseCertificates depends on x/crypto/pkcs12, which doesn't support sha256 for message authentication and I suppose never will because the package is frozen. We're pretty cautious around dependencies that aren't at least standard library adjacent but I'll discuss options with the team. In the meantime, you can use whatever package works for you. ParseCertificates is just an optional helper; credential constructors will take a []*x509.Certificate and a crypto.PrivateKey from any source.

[chlowell]

Thanks again for opening this issue. I discussed it with the rest of the team and we decided we don't want to add a new third-party dependency to get better PKCS12 support (we don't want to choose one on behalf of app developers) or maintain our own PKCS12 parser, so we'll leave ParseCertificates as it is, a best-effort helper limited by the standard library. I updated the docs in #22927 to call out the digest algorithm limitation and suggest working around it and other limitations by using another parser.