Repository: Azure/azure-sdk-for-net
File: sdk/identity/Azure.Identity/src/X509Certificate2FromPathProvider.cs (C#)

Code before:
                }
                string storeName = match.Groups[2].Value;
                string thumbprint = match.Groups[3].Value;

                if (!string.IsNullOrEmpty(CertificatePassword))
                {
                    throw new CredentialUnavailableException("Password protection for certificates from the certificate store is not supported.");
                }

                return LoadCertificateFromStore(storeLocationEnum, storeName, thumbprint);
            }

            string fileType = Path.GetExtension(CertificatePath);

            switch (fileType.ToLowerInvariant())
            {
                case ".pfx":
                    return LoadCertificateFromPfxFileAsync(async, CertificatePath, CertificatePassword, cancellationToken);
                case ".pem":
                    if (CertificatePassword != null)
                    {
                        throw new CredentialUnavailableException("Password protection for PEM encoded certificates is not supported.");
                    }
                    return LoadCertificateFromPemFileAsync(async, CertificatePath, cancellationToken);
                default:
                    throw new CredentialUnavailableException("Certificate path must be in format cert:/StoreLocation/StoreName/Thumbprint, or a file path with .pfx or .pem extension. For example cert://CurrentUser/My/THUMBPRINT. Certificate path provided: " + CertificatePath);
            }
        }

        private static async ValueTask<X509Certificate2> LoadCertificateFromStore(StoreLocation storeLocation, string storeName, string thumbprint)
        {
            using X509Store store = new(storeName, storeLocation);
            store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

            // self signed certificates may be valid here, so don't perform chain validation
            var certs = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);

            return certs.Count switch
            {
                1 => certs[0],
                0 => throw new CredentialUnavailableException($"No certificate found in {storeLocation}/{storeName} store with thumbprint {thumbprint}"),
                _ => throw new CredentialUnavailableException($"{certs.Count} certificates found in {storeLocation}/{storeName} store with thumbprint {thumbprint}")
            };
        }

        // X509Certificate2.X509Certificate2 was made obsolete in .NET 10.0 and replaced by X509CertificateLoader.
        // However, the loader is not available in earlier versions.
        private async ValueTask<X509Certificate2> LoadCertificateFromPfxFileAsync(bool async, string clientCertificatePath, string certificatePassword, CancellationToken cancellationToken)
        {
            if (!(Certificate is null))
            {

Review comment (security):
```suggestion
                    throw new CredentialUnavailableException("Certificate path must be in format cert:/StoreLocation/StoreName/Thumbprint, or a file path with .pfx or .pem extension. For example, cert:/CurrentUser/My/THUMBPRINT. Certificate path provided: " + CertificatePath);
```

Code after:
                }
                string storeName = match.Groups[2].Value;
                string thumbprint = match.Groups[3].Value;

                if (!string.IsNullOrEmpty(CertificatePassword))
                {
                    throw new CredentialUnavailableException("Password protection for certificates from the certificate store is not supported.");
                }

                return LoadCertificateFromStore(storeLocationEnum, storeName, thumbprint);
            }

            string fileType = Path.GetExtension(CertificatePath);

            switch (fileType.ToLowerInvariant())
            {
                case ".pfx":
                    return LoadCertificateFromPfxFileAsync(async, CertificatePath, CertificatePassword, cancellationToken);
                case ".pem":
                    if (CertificatePassword != null)
                    {
                        throw new CredentialUnavailableException("Password protection for PEM encoded certificates is not supported.");
                    }
                    return LoadCertificateFromPemFileAsync(async, CertificatePath, cancellationToken);
                default:
                    throw new CredentialUnavailableException("Certificate path must be in format cert:/StoreLocation/StoreName/Thumbprint, or a file path with .pfx or .pem extension. For example, cert:/CurrentUser/My/THUMBPRINT. Certificate path provided: " + CertificatePath);
            }
        }

        private async ValueTask<X509Certificate2> LoadCertificateFromStore(StoreLocation storeLocation, string storeName, string thumbprint)
        {
            using X509Store store = new(storeName, storeLocation);
            store.Open(OpenFlags.ReadOnly | OpenFlags.OpenExistingOnly);

            // self signed certificates may be valid here, so don't perform chain validation
            var certs = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, validOnly: false);

            return certs.Count switch
            {
                1 => Certificate = certs[0],
                0 => throw new CredentialUnavailableException($"No certificate found in {storeLocation}/{storeName} store with thumbprint {thumbprint}"),
                _ => throw new CredentialUnavailableException($"{certs.Count} certificates found in {storeLocation}/{storeName} store with thumbprint {thumbprint}")
            };
        }

        // X509Certificate2.X509Certificate2 was made obsolete in .NET 10.0 and replaced by X509CertificateLoader.
        // However, the loader is not available in earlier versions.
        private async ValueTask<X509Certificate2> LoadCertificateFromPfxFileAsync(bool async, string clientCertificatePath, string certificatePassword, CancellationToken cancellationToken)
        {
            try
            {