chore: surface wrong-passphrase client cert PEM errors consistently in OpenSSL 3

[mschile]

• Closes n/a (de-flakes CI failure on client_certificates.spec.ts > detects invalid EC PEM passphrase)

Additional details

When clientCertificates is configured with an encrypted PEM key and the wrong passphrase, crypto.createPrivateKey can surface one of two errors depending on what falls out of the failed decryption:

• ERR_OSSL_BAD_DECRYPT — the cipher's padding/MAC check fails.
• error:1E08010C:DECODER routines::unsupported — the decrypted bytes look like a partial DER blob the OpenSSL 3 decoder can't classify.

Which one fires is data-dependent (random IV + random key material → random "decrypted" bytes), so the same wrong passphrase can produce different errors on different runs. The existing code only mapped ERR_OSSL_BAD_DECRYPT to the friendly Cannot decrypt PEM key with supplied passphrase message; the other path leaked through as a generic Cannot parse PEM key: error:1E08010C:DECODER routines::unsupported ….

This change also treats the DECODER routines::unsupported error as a passphrase failure, but only when the key file actually looks like an encrypted PEM (-----BEGIN ENCRYPTED PRIVATE KEY----- or Proc-Type: 4,ENCRYPTED), so a genuinely malformed key with a passphrase still surfaces Cannot parse PEM key.

Side effect: the previously it.skip'd detects invalid PEM key passphrase RSA test (skipped for exactly this flake) is now re-enabled, and the EC variant that prompted this fix is stable. The full client_certificates.spec.ts suite passed 10/10 consecutive runs locally.

---

Note

Medium Risk
Adjusts PEM private-key error classification during client-certificate loading, which can change which failures are treated as passphrase vs malformed-key and affect TLS setup behavior.

Overview
Makes wrong-passphrase failures for encrypted PEM private keys surface consistently under OpenSSL 3 by also mapping the DECODER routines::unsupported path to the existing “Cannot decrypt PEM key…” error, but only when the key text matches an encrypted-PEM pattern.

Adds isEncryptedPemKey to detect encrypted PEM formats and re-enables the previously skipped unit test for invalid RSA PEM passphrases to prevent regressions.

^{Reviewed by Cursor Bugbot for commit 29e67c1. Bugbot is set up for automated code reviews on this repo. Configure here.}

Steps to test

1. Configure a Cypress project with clientCertificates pointing at an encrypted PEM key (either RSA or EC).
2. Put a wrong passphrase in the passphrase file.
3. Run Cypress and observe that the surfaced error is consistently Failed to load client certificates for clientCertificates[0]: Cannot decrypt PEM key with supplied passphrase (check the passphrase file content and that it doesn't have unexpected whitespace at the end). regardless of which OpenSSL 3 decoder path was hit.

How has the user experience changed?

Users who supply a wrong passphrase for an encrypted PEM client certificate now reliably see the helpful "Cannot decrypt PEM key with supplied passphrase" message. Previously, a subset of runs would surface a low-level OpenSSL error:1E08010C:DECODER routines::unsupported message instead, which gave no hint that the passphrase was the problem.

PR Tasks

• [na] Is there an associated issue with maintainer approval for PR submission?
• Have tests been added/updated?
• [na] Has a PR for user-facing changes been opened in cypress-documentation?
• [na] Have API changes been updated in the type definitions?

Cursor Bugbot risk assessment is no longer Low Risk. Auto-approval dismissed; manual review required.

[cypress]

cypress    Run #71045

Run Properties:   Passed #71045  •  29e67c1a95: Merge branch 'develop' into mschile/vibrant-bassi-341a5e

Project	cypress
Branch Review	mschile/vibrant-bassi-341a5e
Run status	Passed #71045
Run duration	18m 48s
Commit	29e67c1a95: Merge branch 'develop' into mschile/vibrant-bassi-341a5e
Committer	Matt Schile
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	12
Pending	1112
Skipped	0
Passing	27307
View all changes introduced in this branch ↗︎

UI Coverage  62.67%
Untested elements	28
Tested elements	47

Accessibility  99%
Failed rules	0 critical   3 serious   1 moderate   0 minor
Failed elements	19

Cursor Bugbot risk assessment is no longer Low Risk. Auto-approval dismissed; manual review required.