spike: test for pkcs12

[filfreire]

Related to INS-4508

Trying to have a reproduction on the tests.

Investigation

• Updating enable-legacy and enable-weak-ssl-ciphers notjaywu/curl-for-windows@2908ea5 🔴 doesn't work - the edited Makefile is not used for windows (https://github.com/Kong/node-libcurl/releases/tag/v2.31.5-alpha.0)
• Updating providers on .cnf files notjaywu/curl-for-windows@master...Kong:curl-for-windows:master 🔴 doesn't work - same as above - the file isn't used (https://github.com/Kong/node-libcurl/releases/tag/v2.31.5-alpha.1)
• Patching the flags into build-openssl.bat that is inside the curl git submodule... that is inside the curl-for-windows submodule 🔴 - doesn't appear to work
• Patching configdata files doesn't work 🔴

Related to image above, maybe we are close ? The legacy related ciphers seem to be included now in the build when openssl is being built, but it doesn't seem to be useful for curl itself

• MacOS and Windows both fail
• MacOS Electron one doesn't fail because tests are skipped for that one
• Electron+Windows test run - it's not possible to setup the NODE_OPTIONS flag required for the test express server - but if the test passes on the NodeJS + Windows build - it should be ok

Ideas to explore

• Find where in the curl codebase the openssl calls to parse the certificate file happen, and see if there's extra work we need to do to include the built legacy openssl files
• Try with a different .P12 file for the test server and client; the current on in this PR (example.p12) is using an old RC2 cipher, which limits what we can test on electron side since it requires the special NODE_OPTIONS flag; maybe modern ciphers work and we just concede the format working with modern versions

Suggestion

We should go with Option B and C of INS-4508

Even if we find a way to enable legacy and weak ciphers on openssl and make it work for libcurl - we are going down a path where we need to maintain curl-for-windows submodule - and on top of that - keep each submodule in that repository, like curl, openssl, brotli, .... up-to-date on Windows, just to have parity between curl version used for MacOS and Linux and the one used for Windows.

Not even curl supports this it seems, looking at curl/curl#8966 - so we should probably avoid going this route.

related research

• curl: (58) could not parse PKCS12 file error curl/curl#8966
• https://stackoverflow.com/questions/72598983/curl-openssl-error-error0308010cdigital-envelope-routinesunsupported
• https://stackoverflow.com/questions/74759898/electron-openssl-legacy-provider-is-not-allowed-in-node-options