[Bogdan Gavril (bgavrilMS)]

Summary

Validate public certificate encodings before x5c construction.

• Decode and parse certificate data using the existing cryptography dependency, then serialize certificate-only DER as base64.
• Preserve PEM certificate chain order, combined PEM input containing other correctly labeled blocks, and legacy tagless base64-DER input with whitespace. Normalize the resulting x5c values by removing encoding whitespace.
• Raise a generic ValueError during credential setup for malformed certificate data that was previously forwarded, including empty input, invalid base64/DER, noncertificate data, and trailing DER bytes. The message does not include the supplied content.
• Leave manual thumbprint selection, no-thumbprint PEM processing, and PFX processing unchanged. Document the supported input forms and changed failure behavior.

Validation

Local isolated environment: Windows, Python 3.14.7, cryptography 50.0.2.

• Confirmed the new regression expectations fail before the implementation change.
• python -m pytest tests/test_application.py tests/test_optional_thumbprint.py -q --tb=short: 130 passed, 21 subtests passed.
• Noninteractive unit suite: 462 passed, 12 skipped, 2 deselected, 690 subtests passed. Exact command:

python -m pytest -q --benchmark-skip --timeout=120 --ignore=tests/test_e2e.py --ignore=tests/test_e2e_manual.py --ignore=tests/test_fmi_e2e.py --ignore=tests/test_mi_e2e.py --ignore=tests/test_agentic_e2e.py --ignore=tests/test_broker.py --deselect=tests/test_cryptography.py::CryptographyTestCase::test_ceiling_should_be_latest_cryptography_version_plus_three --deselect=tests/test_cryptography.py::CryptographyTestCase::test_should_be_run_with_latest_version_of_cryptography --tb=short

• git diff --check and python -m pip check: passed. No standalone CI linter is configured.

Limitations

• This checks certificate encoding, not certificate trust, validity periods, or correspondence with the signing key.
• Live E2E and interactive broker tests were not run. Benchmarks and the two CI warning-only dependency-version checks were excluded. Other supported Python and cryptography versions remain CI validation.

[Copilot]

🟡 Changes recommended

Certificate validation silently accepts truncated PEM chains and lets invalid-version exceptions escape instead of raising the documented ValueError.

2 open issues

• Reject truncated trailing certificate blocks · New
• Handle InvalidVersion during certificate parsing · New

What changed in this PR

This PR validates public certificate encodings before MSAL constructs the x5c header for credentials with a manual thumbprint.

Changes:

• Parse certificates using cryptography and normalize them to base64-encoded DER while preserving PEM chain order.
• Reject malformed certificate data during credential setup and document supported input formats.
• Add regression tests using real certificates for normalization, invalid encodings, and manual-thumbprint behavior.

File	Description
tests/​test_optional_thumbprint.py	Use a real certificate fixture and test manual-thumbprint validation.
tests/​test_application.py	Cover certificate normalization, chain ordering, combined PEM input, and malformed data.
msal/​application.py	Validate certificate data before constructing x5c and document the behavior.

_{Review effort: Balanced}