Could not deserialize PKCS12 data

[eacanalg]

I'm trying to implement a program that signs a request using a pfx file in python 3.12.
Everything is running fine when working in the local env, in an ubuntu pc. But when I try to deploy the code into a lambda app I'm getting the error "Could not deserialize PKCS12 data"

have someone faced this issue previously?

[vog]

I didn't have this issue so far, but given that it only happens on a lambda instance, it might be related to temporary file creation in _create_ssl_context():

• requests_pkcs12/requests_pkcs12.py

  Lines 48 to 69 in a0138bf

  	with tempfile.NamedTemporaryFile(delete=False) as c:
  	try:
  	tmp_pkcs12_password_bytes = secrets.token_bytes(128//8)
  	pk_buf = private_key.private_bytes(
  	cryptography.hazmat.primitives.serialization.Encoding.PEM,
  	cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8,
  	cryptography.hazmat.primitives.serialization.BestAvailableEncryption(password=tmp_pkcs12_password_bytes)
  	)
  	c.write(pk_buf)
  	buf = cert.public_bytes(cryptography.hazmat.primitives.serialization.Encoding.PEM)
  	c.write(buf)
  	if ca_certs:
  	for ca_cert in ca_certs:
  	_check_cert_not_after(ca_cert)
  	buf = ca_cert.public_bytes(cryptography.hazmat.primitives.serialization.Encoding.PEM)
  	c.write(buf)
  	c.flush()
  	c.close()
  	ssl_context.load_cert_chain(c.name, password=tmp_pkcs12_password_bytes)
  	finally:
  	os.remove(c.name)
  	return ssl_context

Note that our temporary files are encrypted and very short-lived (only a few milliseconds during the initialization of an SSL connection), but we didn't manage to get completely rid of them after the respective Python APIs changed a few years ago.

So if my guess is correct, and your issue is about temporary files, you might try one of the following to solve this issue:

• (A) Check if there is a possibility to have temporary files in your lambda instance, and which (perhaps Python-specific) configuration is needed to make it work.
• (B) Find a way to provide the certificates without temporary files to the Python SSL context object, and improve _create_ssl_context() accordingly.

A pull request implementing option (B) would be very welcome.