Add pkcs12 import subcommand to the CLI

[justsmth]

Context and motivation

Scripts commonly extract certs and keys with openssl pkcs12 -in bundle.p12 .... Our CLI had no pkcs12 subcommand, so this adds an import-only one aimed at the usual non-interactive invocations.

Description of changes

Supports -in, -out, -nokeys, -nocerts, -nodes, -noout, -passin, -password, -passout, -legacy, and -help. Built on PKCS12_get_key_and_certs, so the MAC is verified before -out is opened. That is stricter than OpenSSL 1.1.x, which truncates -out before parsing; a successful run still opens/truncates -out even when -noout or -nocerts -nokeys writes nothing.

Output order (certs, then key), -password overriding -passin regardless of order, empty-password handling, and the Mac verify error message match OpenSSL 1.1.x. If a key is to be written, -nodes (unencrypted PKCS#8) or -passout (PKCS#8 encrypted with AES-256-CBC) is required; there is no interactive prompt. -nodes overrides -passout.

-legacy is accepted as a no-op so OpenSSL 3 scripts keep working. This library already decrypts the RC2/3DES bags that flag loads the legacy provider for.

Not implemented: -export, -info, -clcerts/-cacerts, -twopass, -nomacver, -chain, -descert, interactive prompts, and the Bag Attributes comment lines. Those unsupported options fail rather than being ignored.

Testing

38 unit tests plus two comparison tests that export a bundle with the reference OpenSSL and check that both tools produce the same certificates and PEM block sequence. Comparison tests run in CI against OpenSSL 1.1.1 and 3.0.

The unit-test builder uses PKCS12_create defaults, so cert bags are RC2-40 and the key bag is 3DES. Tests do not construct RC4 or OpenSSL 3 PBES2/AES-encrypted bundles (the latter is covered only when the comparison job uses a 3.x openssl pkcs12 -export), and they do not exercise BER indefinite-length inputs (the library handles those).

Review considerations

CLI-only, no public API or FIPS changes. The AWS-LC parser is stricter than OpenSSL in ways that surface here: bundles without a MAC (-export -nomac) are rejected rather than imported with a warning, and bundles with more than one private key are rejected. Like the other subcommands, the CLI ReadAll helper caps input at 1 MiB.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

clang-tidy made some suggestions

[codecov-commenter]

Codecov Report

❌ Patch coverage is 74.73002% with 117 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.57%. Comparing base (01338f5) to head (cdf4449).

Files with missing lines	Patch %	Lines
tool-openssl/pkcs12_test.cc	71.21%	91 Missing and 6 partials ⚠️
tool-openssl/pkcs12.cc	84.12%	20 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3532      +/-   ##
==========================================
+ Coverage   78.38%   78.57%   +0.19%     
==========================================
  Files         700      702       +2     
  Lines      126759   127237     +478     
  Branches    17499    17577      +78     
==========================================
+ Hits        99354    99973     +619     
+ Misses      26516    26366     -150     
- Partials      889      898       +9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

🔒 Security Review — View Report

Please review before merging.