Repository: Azure/azure-sdk-for-net
File: sdk/identity/Azure.Identity/src/X509Certificate2FromPathProvider.cs (C#)

Code before:
                if (!string.IsNullOrEmpty(CertificatePassword))
                {
                    throw new CredentialUnavailableException("Password protection for certificates from the certificate store is not supported.");
                }

                return LoadCertificateFromStore(storeLocationEnum, storeName, thumbprint);
            }

            string fileType = Path.GetExtension(CertificatePath);

            switch (fileType.ToLowerInvariant())
            {
                case ".pfx":
                    return LoadCertificateFromPfxFileAsync(async, CertificatePath, CertificatePassword, cancellationToken);
                case ".pem":
                    if (CertificatePassword != null)
                    {
                        throw new CredentialUnavailableException("Password protection for PEM encoded certificates is not supported.");
                    }
                    return LoadCertificateFromPemFileAsync(async, CertificatePath, cancellationToken);
                default:
                    throw new CredentialUnavailableException("Certificate path must be in format cert:/StoreLocation/StoreName/Thumbprint, or a file path with .pfx or .pem extension. For example cert://CurrentUser/My/THUMBPRINT. Certificate path provided: " + CertificatePath);
            }
        }

        private static async ValueTask<X509Certificate2> LoadCertificateFromStore(StoreLocation storeLocation, string storeName, string thumbprint)
        {
            using X509Store store = new(storeName, storeLocation);
            store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

            // self signed certificates may be valid here, so don't perform chain validation
            var certs = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);

            return certs.Count switch
            {
                1 => certs[0],
                0 => throw new CredentialUnavailableException($"No certificate found in {storeLocation}/{storeName} store with thumbprint {thumbprint}"),
                _ => throw new CredentialUnavailableException($"{certs.Count} certificates found in {storeLocation}/{storeName} store with thumbprint {thumbprint}")
            };
        }

        // X509Certificate2.X509Certificate2 was made obsolete in .NET 10.0 and replaced by X509CertificateLoader.
        // However, the loader is not available in earlier versions.
        private async ValueTask<X509Certificate2> LoadCertificateFromPfxFileAsync(bool async, string clientCertificatePath, string certificatePassword, CancellationToken cancellationToken)
        {
            if (!(Certificate is null))
            {
                return Certificate;
            }

            try

Review comment (suggestion):
Hi @fowl2 - 
We've intentionally avoided implementing loading directly from the system store because this is tricky to do cross-platform. If you feel strongly about contributing this change, please validate via tests that this can work intuitively across Windows, Linux, and Mac OS.

Code after:
                if (!string.IsNullOrEmpty(CertificatePassword))
                {
                    throw new CredentialUnavailableException("Password protection for certificates from the certificate store is not supported.");
                }

                return LoadCertificateFromStore(storeLocationEnum, storeName, thumbprint);
            }

            string fileType = Path.GetExtension(CertificatePath);

            switch (fileType.ToLowerInvariant())
            {
                case ".pfx":
                    return LoadCertificateFromPfxFileAsync(async, CertificatePath, CertificatePassword, cancellationToken);
                case ".pem":
                    if (CertificatePassword != null)
                    {
                        throw new CredentialUnavailableException("Password protection for PEM encoded certificates is not supported.");
                    }
                    return LoadCertificateFromPemFileAsync(async, CertificatePath, cancellationToken);
                default:
                    throw new CredentialUnavailableException("Certificate path must be in format cert:/StoreLocation/StoreName/Thumbprint, or a file path with .pfx or .pem extension. For example, cert:/CurrentUser/My/THUMBPRINT. Certificate path provided: " + CertificatePath);
            }
        }

        private async ValueTask<X509Certificate2> LoadCertificateFromStore(StoreLocation storeLocation, string storeName, string thumbprint)
        {
            using X509Store store = new(storeName, storeLocation);
            store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

            // self signed certificates may be valid here, so don't perform chain validation
            var certs = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);

            return certs.Count switch
            {
                1 => Certificate = certs[0],
                0 => throw new CredentialUnavailableException($"No certificate found in {storeLocation}/{storeName} store with thumbprint {thumbprint}"),
                _ => throw new CredentialUnavailableException($"{certs.Count} certificates found in {storeLocation}/{storeName} store with thumbprint {thumbprint}")
            };
        }

        // X509Certificate2.X509Certificate2 was made obsolete in .NET 10.0 and replaced by X509CertificateLoader.
        // However, the loader is not available in earlier versions.
        private async ValueTask<X509Certificate2> LoadCertificateFromPfxFileAsync(bool async, string clientCertificatePath, string certificatePassword, CancellationToken cancellationToken)
        {
            try
            {
                if (!async)
                {
#if NET10_0_OR_GREATER
                    Certificate = X509CertificateLoader.LoadPkcs12FromFile(clientCertificatePath, certificatePassword);