def get_client_credential(
    certificate_path: Optional[str] = None,
    password: Optional[Union[bytes, str]] = None,
    certificate_data: Optional[bytes] = None,
    send_certificate_chain: bool = False,
    **_: Any
) -> Dict:
    """Load a certificate from a filesystem path or bytes, return it as a dict suitable for msal.ClientApplication.

    :param str certificate_path: Path to a PEM or PKCS12 certificate file.
    :param bytes password: The certificate's password, if any.
    :param bytes certificate_data: The PEM or PKCS12 certificate's bytes.
    :param bool send_certificate_chain: Whether to send the certificate chain. Defaults to False.

    :return: The certificate as a dict
    :rtype: dict
    """

    if certificate_path:
        if certificate_data:
            raise ValueError('Please specify either "certificate_path" or "certificate_data", not both')
        with open(certificate_path, "rb") as f:
            certificate_data = f.read()
    elif not certificate_data:
        raise ValueError('CertificateCredential requires a value for either "certificate_path" or "certificate_data"')

    if password:
        # if password is already bytes, no need to encode.
        if isinstance(password, str):
            password = password.encode("utf-8")
    password = cast("Optional[bytes]", password)

    if b"-----BEGIN" in certificate_data:
        cert = load_pem_certificate(certificate_data, password)
    else:
        cert = load_pkcs12_certificate(certificate_data, password)
        password = None  # load_pkcs12_certificate returns cert.pem_bytes decrypted

    if not isinstance(cert.private_key, RSAPrivateKey):
        raise ValueError("The certificate must have an RSA private key because RS256 is used for signing")

    client_credential = {"private_key": cert.pem_bytes, "thumbprint": hexlify(cert.fingerprint).decode("utf-8")}
    if password:
        client_credential["passphrase"] = password

    if send_certificate_chain:
        try:
            # the JWT needs the whole chain but load_pem_x509_certificate deserializes only the signing cert
            chain = extract_cert_chain(cert.pem_bytes)
            client_credential["public_certificate"] = chain.decode("utf-8")
        except ValueError as ex:
            # we shouldn't land here--cryptography already loaded the cert and would have raised if it were malformed
            raise ValueError("Malformed certificate") from ex

    return client_credential
Load a certificate from a filesystem path or bytes, return it as a dict suitable for msal.ClientApplication.

    :param str certificate_path: Path to a PEM or PKCS12 certificate file.
    :param bytes password: The certificate's password, if any.
    :param bytes certificate_data: The PEM or PKCS12 certificate's bytes.
    :param bool send_certificate_chain: Whether to send the certificate chain. Defaults to False.

    :return: The certificate as a dict
    :rtype: dict
    
Solutions/CyberArkAudit/Data Connectors/.python_packages/lib/site-packages/azure/identity/_credentials/certificate.py