Repository: pyca/pyopenssl
Pull request #1223 (2023-05-31 12:13:31)

Removed deprecated functionality.
Deprecated some functionality that should have been deprecated a long time ago.


Patch:
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index ea84ef5..0525349 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -12,10 +12,14 @@ Backward-incompatible changes:
 
 - Dropped support for Python 3.6.
 - The minimum ``cryptography`` version is now 41.0.0.
+- Removed ``OpenSSL.crypto.loads_pkcs7`` and ``OpenSSL.crypto.loads_pkcs12`` which had been deprecated for 3 years.
 
 Deprecations:
 ^^^^^^^^^^^^^
 
+- Deprecated ``OpenSSL.crypto.PKCS12`` (which was intended to have been deprecated at the same time as ``OpenSSL.crypto.loads_pkcs12``).
+- Deprecated ``OpenSSL.crypto.NetscapeSPKI``.
+
 Changes:
 ^^^^^^^^
 
diff --git a/doc/api/crypto.rst b/doc/api/crypto.rst
index ead4ad0..56eeb83 100644
--- a/doc/api/crypto.rst
+++ b/doc/api/crypto.rst
@@ -68,10 +68,6 @@ Certificate revocation lists
 
 .. autofunction:: load_crl
 
-.. autofunction:: load_pkcs7_data
-
-.. autofunction:: load_pkcs12
-
 Signing and verifying signatures
 --------------------------------
 
@@ -159,21 +155,11 @@ PKey objects
 .. autoclass:: PKey
                :members:
 
-.. _openssl-pkcs7:
-
 .. py:data:: TYPE_RSA
              TYPE_DSA
 
     Key type constants.
 
-PKCS7 objects
--------------
-
-PKCS7 objects have the following methods:
-
-.. autoclass:: PKCS7
-               :members:
-
 .. _openssl-pkcs12:
 
 PKCS12 objects
diff --git a/src/OpenSSL/crypto.py b/src/OpenSSL/crypto.py
index b3f391d..cfe7cca 100644
--- a/src/OpenSSL/crypto.py
+++ b/src/OpenSSL/crypto.py
@@ -63,7 +63,6 @@ __all__ = [
     "dump_privatekey",
     "Revoked",
     "CRL",
-    "PKCS7",
     "PKCS12",
     "NetscapeSPKI",
     "load_publickey",
@@ -74,8 +73,6 @@ __all__ = [
     "verify",
     "dump_crl",
     "load_crl",
-    "load_pkcs7_data",
-    "load_pkcs12",
 ]
 
 
@@ -2567,52 +2564,6 @@ class CRL:
         return dump_crl(type, self)
 
 
-class PKCS7:
-    _pkcs7: Any
-
-    def type_is_signed(self) -> bool:
-        """
-        Check if this NID_pkcs7_signed object
-
-        :return: True if the PKCS7 is of type signed
-        """
-        return bool(_lib.PKCS7_type_is_signed(self._pkcs7))
-
-    def type_is_enveloped(self) -> bool:
-        """
-        Check if this NID_pkcs7_enveloped object
-
-        :returns: True if the PKCS7 is of type enveloped
-        """
-        return bool(_lib.PKCS7_type_is_enveloped(self._pkcs7))
-
-    def type_is_signedAndEnveloped(self) -> bool:
-        """
-        Check if this NID_pkcs7_signedAndEnveloped object
-
-        :returns: True if the PKCS7 is of type signedAndEnveloped
-        """
-        return bool(_lib.PKCS7_type_is_signedAndEnveloped(self._pkcs7))
-
-    def type_is_data(self) -> bool:
-        """
-        Check if this NID_pkcs7_data object
-
-        :return: True if the PKCS7 is of type data
-        """
-        return bool(_lib.PKCS7_type_is_data(self._pkcs7))
-
-    def get_type_name(self) -> str:
-        """
-        Returns the type name of the PKCS7 structure
-
-        :return: A string with the typename
-        """
-        nid = _lib.OBJ_obj2nid(self._pkcs7.type)
-        string_type = _lib.OBJ_nid2sn(nid)
-        return _ffi.string(string_type)
-
-
 class PKCS12:
     """
     A PKCS #12 archive.
@@ -2800,6 +2751,18 @@ class PKCS12:
         return _bio_to_string(bio)
 
 
+utils.deprecated(
+    PKCS12,
+    __name__,
+    (
+        "PKCS#12 support in pyOpenSSL is deprecated. You should use the APIs "
+        "in cryptography."
+    ),
+    DeprecationWarning,
+    name="PKCS12",
+)
+
+
 class NetscapeSPKI:
     """
     A Netscape SPKI object.
@@ -2890,6 +2853,15 @@ class NetscapeSPKI:
         _openssl_assert(set_result == 1)
 
 
+utils.deprecated(
+    NetscapeSPKI,
+    __name__,
+    "NetscapeSPKI support in pyOpenSSL is deprecated.",
+    DeprecationWarning,
+    name="NetscapeSPKI",
+)
+
+
 class _PassphraseHelper:
     def __init__(
         self,
@@ -3229,143 +3201,3 @@ def load_crl(type: int, buffer: Union[str, bytes]) -> CRL:
     result = CRL.__new__(CRL)
     result._crl = _ffi.gc(crl, _lib.X509_CRL_free)
     return result
-
-
-def load_pkcs7_data(type: int, buffer: Union[str, bytes]) -> PKCS7:
-    """
-    Load pkcs7 data from the string *buffer* encoded with the type
-    *type*.
-
-    :param type: The file type (one of FILETYPE_PEM or FILETYPE_ASN1)
-    :param buffer: The buffer with the pkcs7 data.
-    :return: The PKCS7 object
-    """
-    if isinstance(buffer, str):
-        buffer = buffer.encode("ascii")
-
-    bio = _new_mem_buf(buffer)
-
-    if type == FILETYPE_PEM:
-        pkcs7 = _lib.PEM_read_bio_PKCS7(bio, _ffi.NULL, _ffi.NULL, _ffi.NULL)
-    elif type == FILETYPE_ASN1:
-        pkcs7 = _lib.d2i_PKCS7_bio(bio, _ffi.NULL)
-    else:
-        raise ValueError("type argument must be FILETYPE_PEM or FILETYPE_ASN1")
-
-    if pkcs7 == _ffi.NULL:
-        _raise_current_error()
-
-    pypkcs7 = PKCS7.__new__(PKCS7)
-    pypkcs7._pkcs7 = _ffi.gc(pkcs7, _lib.PKCS7_free)
-    return pypkcs7
-
-
-utils.deprecated(
-    load_pkcs7_data,
-    __name__,
-    (
-        "PKCS#7 support in pyOpenSSL is deprecated. You should use the APIs "
-        "in cryptography."
-    ),
-    DeprecationWarning,
-    name="load_pkcs7_data",
-)
-
-
-def load_pkcs12(
-    buffer: Union[str, bytes], passphrase: Optional[bytes] = None
-) -> PKCS12:
-    """
-    Load pkcs12 data from the string *buffer*. If the pkcs12 structure is
-    encrypted, a *passphrase* must be included.  The MAC is always
-    checked and thus required.
-
-    See also the man page for the C function :py:func:`PKCS12_parse`.
-
-    :param buffer: The buffer the certificate is stored in
-    :param passphrase: (Optional) The password to decrypt the PKCS12 lump
-    :returns: The PKCS12 object
-    """
-    passphrase = _text_to_bytes_and_warn("passphrase", passphrase)
-
-    if isinstance(buffer, str):
-        buffer = buffer.encode("ascii")
-
-    bio = _new_mem_buf(buffer)
-
-    # Use null passphrase if passphrase is None or empty string. With PKCS#12
-    # password based encryption no password and a zero length password are two
-    # different things, but OpenSSL implementation will try both to figure out
-    # which one works.
-    if not passphrase:
-        passphrase = _ffi.NULL
-
-    p12 = _lib.d2i_PKCS12_bio(bio, _ffi.NULL)
-    if p12 == _ffi.NULL:
-        _raise_current_error()
-    p12 = _ffi.gc(p12, _lib.PKCS12_free)
-
-    pkey = _ffi.new("EVP_PKEY**")
-    cert = _ffi.new("X509**")
-    cacerts = _ffi.new("Cryptography_STACK_OF_X509**")
-
-    parse_result = _lib.PKCS12_parse(p12, passphrase, pkey, cert, cacerts)
-    if not parse_result:
-        _raise_current_error()
-
-    cacerts = _ffi.gc(cacerts[0], _lib.sk_X509_free)
-
-    # openssl 1.0.0 sometimes leaves an X509_check_private_key error in the
-    # queue for no particular reason.  This error isn't interesting to anyone
-    # outside this function.  It's not even interesting to us.  Get rid of it.
-    try:
-        _raise_current_error()
-    except Error:
-        pass
-
-    if pkey[0] == _ffi.NULL:
-        pykey = None
-    else:
-        pykey = PKey.__new__(PKey)
-        pykey._pkey = _ffi.gc(pkey[0], _lib.EVP_PKEY_free)
-
-    if cert[0] == _ffi.NULL:
-        pycert = None
-        friendlyname = None
-    else:
-        pycert = X509._from_raw_x509_ptr(cert[0])
-
-        friendlyname_length = _ffi.new("int*")
-        friendlyname_buffer = _lib.X509_alias_get0(
-            cert[0], friendlyname_length
-        )
-        friendlyname = _ffi.buffer(
-            friendlyname_buffer, friendlyname_length[0]
-        )[:]
-        if friendlyname_buffer == _ffi.NULL:
-            friendlyname = None
-
-    pycacerts = []
-    for i in range(_lib.sk_X509_num(cacerts)):
-        x509 = _lib.sk_X509_value(cacerts, i)
-        pycacert = X509._from_raw_x509_ptr(x509)
-        pycacerts.append(pycacert)
-
-    pkcs12 = PKCS12.__new__(PKCS12)
-    pkcs12._pkey = pykey
-    pkcs12._cert = pycert
-    pkcs12._cacerts = pycacerts if pycacerts else None
-    pkcs12._friendlyname = friendlyname
-    return pkcs12
-
-
-utils.deprecated(
-    load_pkcs12,
-    __name__,
-    (
-        "PKCS#12 support in pyOpenSSL is deprecated. You should use the APIs "
-        "in cryptography."
-    ),
-    DeprecationWarning,
-    name="load_pkcs12",
-)


Test patch:
diff --git a/tests/test_crypto.py b/tests/test_crypto.py
index 3429231..dc2628c 100644
--- a/tests/test_crypto.py
+++ b/tests/test_crypto.py
@@ -25,9 +25,6 @@ from OpenSSL.crypto import (
     FILETYPE_ASN1,
     FILETYPE_PEM,
     FILETYPE_TEXT,
-    NetscapeSPKI,
-    PKCS12,
-    PKCS7,
     PKey,
     Revoked,
     TYPE_DSA,
@@ -57,7 +54,7 @@ from OpenSSL.crypto import (
 )
 
 with pytest.warns(DeprecationWarning):
-    from OpenSSL.crypto import load_pkcs12, load_pkcs7_data
+    from OpenSSL.crypto import PKCS12, NetscapeSPKI
 
 from .util import (
     EqualityTestsMixin,
@@ -555,57 +552,6 @@ ywIDAQAB
 -----END PUBLIC KEY-----
 """
 
-# Some PKCS#7 stuff.  Generated with the openssl command line:
-#
-#    openssl crl2pkcs7 -inform pem -outform pem -certfile s.pem -nocrl
-#
-# with a certificate and key (but the key should be irrelevant) in s.pem
-pkcs7Data = b"""\
------BEGIN PKCS7-----
-MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExADALBgkqhkiG9w0BBwGgggMKMIID
-BjCCAm+gAwIBAgIBATANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJTRzERMA8G
-A1UEChMITTJDcnlwdG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtN
-MkNyeXB0byBDZXJ0aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNA
-cG9zdDEuY29tMB4XDTAwMDkxMDA5NTEzMFoXDTAyMDkxMDA5NTEzMFowUzELMAkG
-A1UEBhMCU0cxETAPBgNVBAoTCE0yQ3J5cHRvMRIwEAYDVQQDEwlsb2NhbGhvc3Qx
-HTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tMFwwDQYJKoZIhvcNAQEBBQAD
-SwAwSAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh5kwI
-zOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAw
-LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G
-A1UdDgQWBBTPhIKSvnsmYsBVNWjj0m3M2z0qVTCBpQYDVR0jBIGdMIGagBT7hyNp
-65w6kxXlxb8pUU/+7Sg4AaF/pH0wezELMAkGA1UEBhMCU0cxETAPBgNVBAoTCE0y
-Q3J5cHRvMRQwEgYDVQQLEwtNMkNyeXB0byBDQTEkMCIGA1UEAxMbTTJDcnlwdG8g
-Q2VydGlmaWNhdGUgTWFzdGVyMR0wGwYJKoZIhvcNAQkBFg5uZ3BzQHBvc3QxLmNv
-bYIBADANBgkqhkiG9w0BAQQFAAOBgQA7/CqT6PoHycTdhEStWNZde7M/2Yc6BoJu
-VwnW8YxGO8Sn6UJ4FeffZNcYZddSDKosw8LtPOeWoK3JINjAk5jiPQ2cww++7QGG
-/g5NDjxFZNDJP1dGiLAxPW6JXwov4v0FmdzfLOZ01jDcgQQZqEpYlgpuI5JEWUQ9
-Ho4EzbYCOaEAMQA=
------END PKCS7-----
-"""
-
-pkcs7DataASN1 = base64.b64decode(
-    b"""
-MIIDNwYJKoZIhvcNAQcCoIIDKDCCAyQCAQExADALBgkqhkiG9w0BBwGgggMKMIID
-BjCCAm+gAwIBAgIBATANBgkqhkiG9w0BAQQFADB7MQswCQYDVQQGEwJTRzERMA8G
-A1UEChMITTJDcnlwdG8xFDASBgNVBAsTC00yQ3J5cHRvIENBMSQwIgYDVQQDExtN
-MkNyeXB0byBDZXJ0aWZpY2F0ZSBNYXN0ZXIxHTAbBgkqhkiG9w0BCQEWDm5ncHNA
-cG9zdDEuY29tMB4XDTAwMDkxMDA5NTEzMFoXDTAyMDkxMDA5NTEzMFowUzELMAkG
-A1UEBhMCU0cxETAPBgNVBAoTCE0yQ3J5cHRvMRIwEAYDVQQDEwlsb2NhbGhvc3Qx
-HTAbBgkqhkiG9w0BCQEWDm5ncHNAcG9zdDEuY29tMFwwDQYJKoZIhvcNAQEBBQAD
-SwAwSAJBAKy+e3dulvXzV7zoTZWc5TzgApr8DmeQHTYC8ydfzH7EECe4R1Xh5kwI
-zOuuFfn178FBiS84gngaNcrFi0Z5fAkCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAw
-LAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0G
-A1UdDgQWBBTPhIKSvnsmYsBVNWjj0m3M2z0qVTCBpQYDVR0jBIGdMIGagBT7hyNp
-65w6kxXlxb8pUU/+7Sg4AaF/pH0wezELMAkGA1UEBhMCU0cxETAPBgNVBAoTCE0y
-Q3J5cHRvMRQwEgYDVQQLEwtNMkNyeXB0byBDQTEkMCIGA1UEAxMbTTJDcnlwdG8g
-Q2VydGlmaWNhdGUgTWFzdGVyMR0wGwYJKoZIhvcNAQkBFg5uZ3BzQHBvc3QxLmNv
-bYIBADANBgkqhkiG9w0BAQQFAAOBgQA7/CqT6PoHycTdhEStWNZde7M/2Yc6BoJu
-VwnW8YxGO8Sn6UJ4FeffZNcYZddSDKosw8LtPOeWoK3JINjAk5jiPQ2cww++7QGG
-/g5NDjxFZNDJP1dGiLAxPW6JXwov4v0FmdzfLOZ01jDcgQQZqEpYlgpuI5JEWUQ9
-Ho4EzbYCOaEAMQA=
-"""
-)
-
 crlData = b"""\
 -----BEGIN X509 CRL-----
 MIIBWzCBxTANBgkqhkiG9w0BAQQFADBYMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
@@ -2387,7 +2333,7 @@ class TestX509Store:
 
 class TestPKCS12:
     """
-    Test for `OpenSSL.crypto.PKCS12` and `OpenSSL.crypto.load_pkcs12`.
+    Test for `OpenSSL.crypto.PKCS12`.
     """
 
     def test_type(self):
@@ -2430,7 +2376,7 @@ class TestPKCS12:
     def test_key_only(self):
         """
         A `PKCS12` with only a private key can be exported using
-        `PKCS12.export` and loaded again using `load_pkcs12`.
+        `PKCS12.export`.
         """
         passwd = b"blah"
         p12 = PKCS12()
@@ -2438,25 +2384,12 @@ class TestPKCS12:
         p12.set_privatekey(pkey)
         assert None is p12.get_certificate()
         assert pkey == p12.get_privatekey()
-        try:
-            dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3)
-        except Error:
-            # Some versions of OpenSSL will throw an exception
-            # for this nearly useless PKCS12 we tried to generate:
-            # [('PKCS12 routines', 'PKCS12_create', 'invalid null argument')]
-            return
-        p12 = load_pkcs12(dumped_p12, passwd)
-        assert None is p12.get_ca_certificates()
-        assert None is p12.get_certificate()
-
-        # OpenSSL fails to bring the key back to us.  So sad.  Perhaps in the
-        # future this will be improved.
-        assert isinstance(p12.get_privatekey(), (PKey, type(None)))
+        p12.export(passphrase=passwd, iter=2, maciter=3)
 
     def test_cert_only(self):
         """
         A `PKCS12` with only a certificate can be exported using
-        `PKCS12.export` and loaded again using `load_pkcs12`.
+        `PKCS12.export`.
         """
         passwd = b"blah"
         p12 = PKCS12()
@@ -2464,51 +2397,26 @@ class TestPKCS12:
         p12.set_certificate(cert)
         assert cert == p12.get_certificate()
         assert None is p12.get_privatekey()
-        try:
-            dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3)
-        except Error:
-            # Some versions of OpenSSL will throw an exception
-            # for this nearly useless PKCS12 we tried to generate:
-            # [('PKCS12 routines', 'PKCS12_create', 'invalid null argument')]
-            return
-        p12 = load_pkcs12(dumped_p12, passwd)
-        assert None is p12.get_privatekey()
+        p12.export(passphrase=passwd, iter=2, maciter=3)
 
-        # OpenSSL fails to bring the cert back to us.  Groany mcgroan.
-        assert isinstance(p12.get_certificate(), (X509, type(None)))
-
-        # Oh ho.  It puts the certificate into the ca certificates list, in
-        # fact.  Totally bogus, I would think.  Nevertheless, let's exploit
-        # that to check to see if it reconstructed the certificate we expected
-        # it to.  At some point, hopefully this will change so that
-        # p12.get_certificate() is actually what returns the loaded
-        # certificate.
-        assert root_cert_pem == dump_certificate(
-            FILETYPE_PEM, p12.get_ca_certificates()[0]
-        )
-
-    def gen_pkcs12(
-        self, cert_pem=None, key_pem=None, ca_pem=None, friendly_name=None
-    ):
+    def gen_pkcs12(self, cert_pem=None, key_pem=None, ca_pem=None):
         """
         Generate a PKCS12 object with components from PEM.  Verify that the set
         functions return None.
         """
         p12 = PKCS12()
-        if cert_pem:
-            ret = p12.set_certificate(load_certificate(FILETYPE_PEM, cert_pem))
-            assert ret is None
-        if key_pem:
-            ret = p12.set_privatekey(load_privatekey(FILETYPE_PEM, key_pem))
-            assert ret is None
+
+        ret = p12.set_certificate(load_certificate(FILETYPE_PEM, cert_pem))
+        assert ret is None
+
+        ret = p12.set_privatekey(load_privatekey(FILETYPE_PEM, key_pem))
+        assert ret is None
+
         if ca_pem:
             ret = p12.set_ca_certificates(
                 (load_certificate(FILETYPE_PEM, ca_pem),)
             )
             assert ret is None
-        if friendly_name:
-            ret = p12.set_friendlyname(friendly_name)
-            assert ret is None
         return p12
 
     def check_recovery(
@@ -2518,29 +2426,29 @@ class TestPKCS12:
         Use openssl program to confirm three components are recoverable from a
         PKCS12 string.
         """
-        if key:
-            recovered_key = _runopenssl(
-                p12_str,
-                b"pkcs12",
-                b"-nocerts",
-                b"-nodes",
-                b"-passin",
-                b"pass:" + passwd,
-                *extra,
-            ).replace(b"\r\n", b"\n")
-            assert recovered_key[-len(key) :] == key
-        if cert:
-            recovered_cert = _runopenssl(
-                p12_str,
-                b"pkcs12",
-                b"-clcerts",
-                b"-nodes",
-                b"-passin",
-                b"pass:" + passwd,
-                b"-nokeys",
-                *extra,
-            ).replace(b"\r\n", b"\n")
-            assert recovered_cert[-len(cert) :] == cert
+        recovered_key = _runopenssl(
+            p12_str,
+            b"pkcs12",
+            b"-nocerts",
+            b"-nodes",
+            b"-passin",
+            b"pass:" + passwd,
+            *extra,
+        ).replace(b"\r\n", b"\n")
+        assert recovered_key[-len(key) :] == key
+
+        recovered_cert = _runopenssl(
+            p12_str,
+            b"pkcs12",
+            b"-clcerts",
+            b"-nodes",
+            b"-passin",
+            b"pass:" + passwd,
+            b"-nokeys",
+            *extra,
+        ).replace(b"\r\n", b"\n")
+        assert recovered_cert[-len(cert) :] == cert
+
         if ca:
             recovered_cert = _runopenssl(
                 p12_str,
@@ -2554,138 +2462,6 @@ class TestPKCS12:
             ).replace(b"\r\n", b"\n")
             assert recovered_cert[-len(ca) :] == ca
 
-    def verify_pkcs12_container(self, p12):
-        """
-        Verify that the PKCS#12 container contains the correct client
-        certificate and private key.
-
-        :param p12: The PKCS12 instance to verify.
-        :type p12: `PKCS12`
-        """
-        cert_pem = dump_certificate(FILETYPE_PEM, p12.get_certificate())
-        key_pem = dump_privatekey(FILETYPE_PEM, p12.get_privatekey())
-        assert (client_cert_pem, client_key_pem, None) == (
-            cert_pem,
-            key_pem,
-            p12.get_ca_certificates(),
-        )
-
-    def test_load_pkcs12(self):
-        """
-        A PKCS12 string generated using the openssl command line can be loaded
-        with `load_pkcs12` and its components extracted and examined.
-        """
-        passwd = b"whatever"
-        pem = client_key_pem + client_cert_pem
-        p12_str = _runopenssl(
-            pem,
-            b"pkcs12",
-            b"-export",
-            b"-clcerts",
-            b"-passout",
-            b"pass:" + passwd,
-        )
-        p12 = load_pkcs12(p12_str, passphrase=passwd)
-        self.verify_pkcs12_container(p12)
-
-    def test_load_pkcs12_text_passphrase(self):
-        """
-        A PKCS12 string generated using the openssl command line can be loaded
-        with `load_pkcs12` and its components extracted and examined.
-        Using text as passphrase instead of bytes. DeprecationWarning expected.
-        """
-        pem = client_key_pem + client_cert_pem
-        passwd = b"whatever"
-        p12_str = _runopenssl(
-            pem,
-            b"pkcs12",
-            b"-export",
-            b"-clcerts",
-            b"-passout",
-            b"pass:" + passwd,
-        )
-        with pytest.warns(DeprecationWarning) as w:
-            warnings.simplefilter("always")
-            p12 = load_pkcs12(p12_str, passphrase=b"whatever".decode("ascii"))
-            msg = "{0} for passphrase is no longer accepted, use bytes".format(
-                WARNING_TYPE_EXPECTED
-            )
-            assert msg == str(w[-1].message)
-
-        self.verify_pkcs12_container(p12)
-
-    def test_load_pkcs12_no_passphrase(self):
-        """
-        A PKCS12 string generated using openssl command line can be loaded with
-        `load_pkcs12` without a passphrase and its components extracted
-        and examined.
-        """
-        pem = client_key_pem + client_cert_pem
-        p12_str = _runopenssl(
-            pem, b"pkcs12", b"-export", b"-clcerts", b"-passout", b"pass:"
-        )
-        p12 = load_pkcs12(p12_str)
-        self.verify_pkcs12_container(p12)
-
-    def _dump_and_load(self, dump_passphrase, load_passphrase):
-        """
-        A helper method to dump and load a PKCS12 object.
-        """
-        p12 = self.gen_pkcs12(client_cert_pem, client_key_pem)
-        dumped_p12 = p12.export(passphrase=dump_passphrase, iter=2, maciter=3)
-        return load_pkcs12(dumped_p12, passphrase=load_passphrase)
-
-    def test_load_pkcs12_null_passphrase_load_empty(self):
-        """
-        A PKCS12 string can be dumped with a null passphrase, loaded with an
-        empty passphrase with `load_pkcs12`, and its components
-        extracted and examined.
-        """
-        self.verify_pkcs12_container(
-            self._dump_and_load(dump_passphrase=None, load_passphrase=b"")
-        )
-
-    def test_load_pkcs12_null_passphrase_load_null(self):
-        """
-        A PKCS12 string can be dumped with a null passphrase, loaded with a
-        null passphrase with `load_pkcs12`, and its components
-        extracted and examined.
-        """
-        self.verify_pkcs12_container(
-            self._dump_and_load(dump_passphrase=None, load_passphrase=None)
-        )
-
-    def test_load_pkcs12_empty_passphrase_load_empty(self):
-        """
-        A PKCS12 string can be dumped with an empty passphrase, loaded with an
-        empty passphrase with `load_pkcs12`, and its components
-        extracted and examined.
-        """
-        self.verify_pkcs12_container(
-            self._dump_and_load(dump_passphrase=b"", load_passphrase=b"")
-        )
-
-    def test_load_pkcs12_empty_passphrase_load_null(self):
-        """
-        A PKCS12 string can be dumped with an empty passphrase, loaded with a
-        null passphrase with `load_pkcs12`, and its components
-        extracted and examined.
-        """
-        self.verify_pkcs12_container(
-            self._dump_and_load(dump_passphrase=b"", load_passphrase=None)
-        )
-
-    def test_load_pkcs12_garbage(self):
-        """
-        `load_pkcs12` raises `OpenSSL.crypto.Error` when passed
-        a string which is not a PKCS12 dump.
-        """
-        passwd = b"whatever"
-        with pytest.raises(Error) as err:
-            load_pkcs12(b"fruit loops", passwd)
-        assert err.value.args[0][0][0] == "asn1 encoding routines"
-        assert len(err.value.args[0][0]) == 3
-
     def test_replace(self):
         """
         `PKCS12.set_certificate` replaces the certificate in a PKCS12
@@ -2716,20 +2492,7 @@ class TestPKCS12:
         for friendly_name in [b"Serverlicious", None, b"###"]:
             p12.set_friendlyname(friendly_name)
             assert p12.get_friendlyname() == friendly_name
-            dumped_p12 = p12.export(passphrase=passwd, iter=2, maciter=3)
-            reloaded_p12 = load_pkcs12(dumped_p12, passwd)
-            assert p12.get_friendlyname() == reloaded_p12.get_friendlyname()
-            # We would use the openssl program to confirm the friendly
-            # name, but it is not possible.  The pkcs12 command
-            # does not store the friendly name in the cert's
-            # alias, which we could then extract.
-            self.check_recovery(
-                dumped_p12,
-                key=server_key_pem,
-                cert=server_cert_pem,
-                ca=root_cert_pem,
-                passwd=passwd,
-            )
+            p12.export(passphrase=passwd, iter=2, maciter=3)
 
     def test_various_empty_passphrases(self):
         """
@@ -2780,19 +2543,7 @@ class TestPKCS12:
         """
         passwd = b"Lake Michigan"
         p12 = self.gen_pkcs12(server_cert_pem, server_key_pem, root_cert_pem)
-        dumped_p12 = p12.export(maciter=-1, passphrase=passwd, iter=2)
-        try:
-            recovered_p12 = load_pkcs12(dumped_p12, passwd)
-            # The person who generated this PCKS12 should be flogged,
-            # or better yet we should have a means to determine
-            # whether a PCKS12 had a MAC that was verified.
-            # Anyway, libopenssl chooses to allow it, so the
-            # pyopenssl binding does as well.
-            assert isinstance(recovered_p12, PKCS12)
-        except Error:
-            # Failing here with an exception is preferred as some openssl
-            # versions do.
-            pass
+        p12.export(maciter=-1, passphrase=passwd, iter=2)
 
     def test_zero_len_list_for_ca(self):
         """
@@ -3291,36 +3042,6 @@ class TestFunction:
         with pytest.raises(Error):
             load_privatekey(FILETYPE_PEM, encrypted_key_pem, passphrase)
 
-    def test_load_pkcs7_data_pem(self):
-        """
-        `load_pkcs7_data` accepts a PKCS#7 string and returns an instance of
-        `PKCS`.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        assert isinstance(pkcs7, PKCS7)
-
-    def test_load_pkcs7_data_asn1(self):
-        """
-        `load_pkcs7_data` accepts a bytes containing ASN1 data representing
-        PKCS#7 and returns an instance of `PKCS7`.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_ASN1, pkcs7DataASN1)
-        assert isinstance(pkcs7, PKCS7)
-
-    def test_load_pkcs7_data_invalid(self):
-        """
-        If the data passed to `load_pkcs7_data` is invalid, `Error` is raised.
-        """
-        with pytest.raises(Error):
-            load_pkcs7_data(FILETYPE_PEM, b"foo")
-
-    def test_load_pkcs7_type_invalid(self):
-        """
-        If the type passed to `load_pkcs7_data`, `ValueError` is raised.
-        """
-        with pytest.raises(ValueError):
-            load_pkcs7_data(object(), b"foo")
-
 
 class TestLoadCertificate:
     """
@@ -3346,61 +3067,6 @@ class TestLoadCertificate:
             load_certificate(FILETYPE_ASN1, b"lol")
 
 
-class TestPKCS7:
-    """
-    Tests for `PKCS7`.
-    """
-
-    def test_type_is_signed(self):
-        """
-        `PKCS7.type_is_signed` returns `True` if the PKCS7 object is of
-        the type *signed*.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        assert pkcs7.type_is_signed()
-
-    def test_type_is_enveloped(self):
-        """
-        `PKCS7.type_is_enveloped` returns `False` if the PKCS7 object is not
-        of the type *enveloped*.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        assert not pkcs7.type_is_enveloped()
-
-    def test_type_is_signed_and_enveloped(self):
-        """
-        `PKCS7.type_is_signedAndEnveloped` returns `False`
-        if the PKCS7 object is not of the type *signed and enveloped*.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        assert not pkcs7.type_is_signedAndEnveloped()
-
-    def test_type_is_data(self):
-        """
-        `PKCS7.type_is_data` returns `False` if the PKCS7 object is not of
-        the type data.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        assert not pkcs7.type_is_data()
-
-    def test_get_type_name(self):
-        """
-        `PKCS7.get_type_name` returns a `str` giving the
-        type name.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        assert pkcs7.get_type_name() == b"pkcs7-signedData"
-
-    def test_attribute(self):
-        """
-        If an attribute other than one of the methods tested here is accessed
-        on an instance of `PKCS7`, `AttributeError` is raised.
-        """
-        pkcs7 = load_pkcs7_data(FILETYPE_PEM, pkcs7Data)
-        with pytest.raises(AttributeError):
-            pkcs7.foo
-
-
 class TestNetscapeSPKI(_PKeyInteractionTestsMixin):
     """
     Tests for `OpenSSL.crypto.NetscapeSPKI`.