Are pfx files (used as key files) unsupported in asyncua

[KishanKishore]

I am getting the following error when trying to use a pfx file as my private key. The OPCUA specification (https://reference.opcfoundation.org/v104/GDS/docs/F.1/) states the key could be in either pfx or pem formats. The pem format works as expected.

File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/asyncua/client/client.py", line 132, in set_security_string
    return await self.set_security(policy_class, parts[2], parts[3], client_key_password, parts[4] if len(parts) >= 5 else None, mode)
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/asyncua/client/client.py", line 158, in set_security
    return await self._set_security(policy, certificate, private_key, server_certificate, mode)
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/asyncua/client/client.py", line 175, in _set_security
    private_key.extension,
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/asyncua/crypto/uacrypto.py", line 50, in load_private_key
    return serialization.load_der_private_key(await f.read(), password=password, backend=default_backend())
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/cryptography/hazmat/primitives/serialization/base.py", line 37, in load_der_private_key
    return backend.load_der_private_key(data, password)
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1277, in load_der_private_key
    password,
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1448, in _load_key
    self._handle_key_loading_error()
  File "/Users/kishan/Documents/Configuration/edge-sdk/lib/python3.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1491, in _handle_key_loading_error
    "Could not deserialize key data. The data may be in an "
ValueError: Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.

I am using the set_security_string method to set the security modes/ security policies etc. Any suggestions here ? Is there any restriction on the key and certificate formats that can be used with asyncua ?

[ZuZuD]

The library currently only supports the PEM (Base64 ASCII) and DER format (Binary):
https://github.com/FreeOpcUa/opcua-asyncio/blob/master/asyncua/crypto/uacrypto.py#L29-L31

Of course, you can convert your pfx certs in PEM/DEM with tools like openssl, few examples on how to achieve this here:
https://knowledge.digicert.com/solution/SO26449.html

[KishanKishore]

Thanks for the reply @ZuZuD . Yes we can definitely convert between the formats but just wanted to know if they are supported out of the box.