Is your feature request related to a problem? Please describe.

Services that use openssl v3 and don't support the "legacy" flag cannot use PKCS12 keystores created by cert-manager.

cert-manager has the ability to create a PKCS12 keystore. cert-manager encrypts the PKCS7 key with RC2-40-CBC and a SHA1 MAC (pbeWithSHA1And40BitRC2-CBC). This is dictated by the hardcoded algorithm used in the go-pkcs12 dependency.

In openssl version 3, the RC2 algorithm is now considered "legacy" and AES 256-bit or greater with SHA-256 should be used instead.

Here's an example of a keystore generated by cert-manager:

$ openssl pkcs12 -in keystore.p12 -info
Enter Import Password:
MAC: sha1, Iteration 1
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
...

Describe the solution you'd like
Allow configuration of the algorithms for encryption and MAC so that AES-256-CBC with SHA-256 can be used for newer services, while allowing RC2-40-CBC with SHA1 for backwards compatibility.

Describe alternatives you've considered
Current workaround is to downgrade the services that use openssl v3 to when they supported openssl v1, however this means those services can no longer be patched/upgraded!

Additional context
cert-manager's pkcs12 implementation currently does not allow specifying an algorithm because the upstream (go-pkcs12) is hard-coded to use RC2-40-CBC, per the software.sslmate.com/src/go-pkcs12 docs:

EncodeTrustStore creates a single SafeContents that's encrypted with RC2 and contains the certificates.

There's a PR open against sslmate's go-pkcs12 module that adds support for picking other algos that would satisfy this feature request, if only it would be merged: SSLMate/go-pkcs12#39.

Environment details (remove if not applicable):

• Kubernetes version: 1.25.8
• Cloud-provider/provisioner: nocloud
• cert-manager version: 1.11.1
• Install method: helm

/kind feature