update as per discussion

Author: Vit Curda

msal/application.py

@@ -308,7 +308,7 @@ def __init__(
 
                     {
                         "private_key": "...-----BEGIN PRIVATE KEY-----... in PEM format",
-                        "thumbprint": "A1B2C3D4E5F6...", (Optinal, if not provided, MSAL will calculate it. Added in version 1.34.0)
+                        "thumbprint": "A1B2C3D4E5F6...", (Deprecated. Provide the public certificate instead. Added in version 1.34.0)
                         "public_certificate": "...-----BEGIN CERTIFICATE-----...",
                         "passphrase": "Passphrase if the private_key is encrypted (Optional. Added in version 1.6.0)",
                     }
@@ -819,13 +819,20 @@ def _build_client(self, client_credential, authority, skip_regional_client=False
                         headers["x5c"] = x5c
                 elif (client_credential.get("private_key") 
                       and client_credential.get("public_certificate") 
-                      and not client_credential.get("thumbprint")): # in case user does not pass thumbprint but only certificate and private key
+                      and not client_credential.get("thumbprint")): #in case user does not pass thumbprint but only certificate and private key
+                        if passphrase_bytes: # PEM with passphrase
+                            private_key = _load_private_key_from_pem_str(
+                                client_credential['private_key'], passphrase_bytes)
+                        else:  # PEM without passphrase
+                            private_key = client_credential['private_key']
+                        
                         private_key, sha256_thumbprint, sha1_thumbprint, x5c =(
                              _extract_cert_and_thumbprints(
-                                client_credential['private_key'],
+                                private_key,
                                 client_credential['public_certificate']))
                         if x5c:
                             headers["x5c"] = x5c
+
                 elif (
                         client_credential.get("private_key")  # PEM blob
                         and client_credential.get("thumbprint")):