[domenkozar]

Importing an OpenSSL PFX in Raw mode can lose its private key: OpenSSL commonly assigns the same friendly name to the key and leaf certificate, and the later certificate insertion overwrites the key. Certificate bags with duplicate names can also overwrite one another. Linked imports additionally filter bags, so applications cannot inspect every certificate before applying their own chain validation.

This adds Pkcs12Archive::from_pkcs12 and documented bag types to expose supported decoded bags before alias mapping, linking, or filtering. It retains duplicate and unrelated certificates, preserves per-collection order and bag metadata, and includes private keys without a local key ID. It shares the existing MAC verification and decryption path with KeyStore.

Keystore imports retain colliding aliases with #2, #3, etc. suffixes. The existing Strict filtering and chain-linking behavior remain available. The archive API performs no certificate signature, expiry, or key-match validation, and unsupported bag types are still ignored; these limits are documented.

Validation with rustc 1.97.1:

• cargo fmt --check
• cargo clippy --workspace --examples --tests -- -D warnings
• cargo test --workspace --examples --tests
• cargo test --no-default-features --test test_archive
• RUSTDOCFLAGS=-Dwarnings cargo doc --no-deps
• Independent OpenSSL interoperability probes, including duplicate bags, unrelated certificates, and colliding key/certificate names.

This API is motivated by migrating SecretSpec's PKCS#12 identity support away from OpenSSL while retaining its existing certificate validation rules. Prepared with Codex assistance.

[domenkozar]

cc @ancwrd1

[ancwrd1]

Thanks for the pull request!

[domenkozar]

@ancwrd1 any chance for a release? 🙏

[ancwrd1]

I probably have to bump the version to 0.4, as it adds some new interfaces.

[ancwrd1]

Done