func ReadPKCS12Data()

in aws_signing_helper/signer.go [752:817]
55 lines of code
13 McCabe index (conditional complexity)

func ReadPKCS12Data(certificateId string) (certChain []*x509.Certificate, privateKey crypto.PrivateKey, err error) {
	var (
		bytes               []byte
		pemBlocks           []*pem.Block
		parsedCerts         []*x509.Certificate
		certMap             map[string]*x509.Certificate
		endEntityFoundIndex int
	)

	bytes, err = os.ReadFile(certificateId)
	if err != nil {
		return nil, nil, err
	}

	pemBlocks, err = pkcs12.ToPEM(bytes, "")
	if err != nil {
		return nil, "", err
	}

	for _, block := range pemBlocks {
		cert, err := x509.ParseCertificate(block.Bytes)
		if err == nil {
			parsedCerts = append(parsedCerts, cert)
			continue
		}
		privateKeyTmp, err := ReadPrivateKeyDataFromPEMBlock(block)
		if err == nil {
			privateKey = privateKeyTmp
			continue
		}
		// If neither a certificate nor a private key could be parsed from the
		// Block, ignore it and continue.
		if Debug {
			log.Println("unable to parse PEM block in PKCS#12 file - skipping")
		}
	}

	certMap = make(map[string]*x509.Certificate)
	for _, cert := range parsedCerts {
		// pkix.Name.String() roughly follows the RFC 2253 Distinguished Names
		// syntax, so we assume that it's canonical.
		issuer := cert.Issuer.String()
		certMap[issuer] = cert
	}

	endEntityFoundIndex = -1
	for i, cert := range parsedCerts {
		subject := cert.Subject.String()
		if _, ok := certMap[subject]; !ok {
			certChain = append(certChain, cert)
			endEntityFoundIndex = i
			break
		}
	}
	if Debug {
		log.Println("no end-entity certificate found in PKCS#12 file")
	}

	for i, cert := range parsedCerts {
		if i != endEntityFoundIndex {
			certChain = append(certChain, cert)
		}
	}

	return certChain, privateKey, nil
}