HPDFLoadHeadlessPFXIdentity

procedure HPDFLoadHeadlessPFXIdentity(const PFX: SysUtils.TBytes;
  const Password: UnicodeString; MaximumBytes: Integer;
  out CertificatePEM, PrivateKeyPEM: SysUtils.TBytes);

Decodes and authenticates a bounded PKCS12 DER identity using OpenSSL 3, returning the leaf and chain certificates as PEM and the matching private key as unencrypted PEM

Input DER and each PEM output must fit within MaximumBytes; passwords use UTF-8, an embedded NUL is rejected and trailing DER data is not accepted

The function never prompts for a password and clears the internal password and private-key serialisation buffers

The caller owns both of the returned arrays and must clear PrivateKeyPEM after use; SignPFXToFile performs this cleanup automatically