PKCS#12 DER support

[chiptech-andrew]

When I generate a PFX file and upload it to an Azure Container Apps Environment, it generates this warning:

PKCS#12 bundle could not be parsed as DER, falling back to parsing as BER. Please file an issue at https://github.com/pyca/cryptography/issues explaining how your PKCS#12 bundle was created. In the future, this may become an exception.

I've added a comment to pyca/cryptography#12936.

Is there a way to get POSH ACME using DER instead of BER?

[rmbolger]

Hey @chiptech-andrew, thanks for reaching out. The crypto library I'm using under the hood does appear to encode as BER by default. But it supports DER as well. I didn't even realize I had a choice. The internet would have me believe DER should be the more compatible encoding method, but I'm hesitant to change any defaults that might affect compatibility (even for the better) outside of a major version change.

That said, I could totally add an order-level switch like -UsePfxDerEncoding that works just like the existing -UseModernPfxEncryption and perhaps a plan to make it the new default in 5.x. Would that work?

[rmbolger]

The -UsePfxDerEncording switch has been added to the dev/main branch if you want to test it out.

[chiptech-andrew]

Thank you! I will try it out