HPDFLoadHeadlessPFXIdentity

procedure HPDFLoadHeadlessPFXIdentity(const PFX: SysUtils.TBytes;
  const Password: UnicodeString; MaximumBytes: Integer;
  out CertificatePEM, PrivateKeyPEM: SysUtils.TBytes);

Decodes and authenticates a bounded PKCS12 DER identity with OpenSSL 3, returning the leaf and chain certificates as PEM and the matching private key as unencrypted PEM

Input DER and each PEM output must fit MaximumBytes; passwords use UTF-8, embedded NUL is rejected, and trailing DER data is not accepted

The function never prompts for a password and clears internal password and private-key serialization buffers

The caller owns both returned arrays and must clear PrivateKeyPEM after use; SignPFXToFile performs this cleanup automatically