Remove dependency on OpenSSL

[macladson]

Issue Addressed

#8756

Proposed Changes

Only the Web3Signer actually needs OpenSSL in order to parse PKCS12 certificates. This updates the function to instead manually parse the cert (using the p12-keystore crate) and converts it to a PEM certificate (using the pem crate) which can be directly converted to a reqwest::tls::Identity as this can be done directly in rustls.

Additional Info

There may be some situations where a .p12 certificate could be strangely formatted (for example, if not generated by openssl) and break this function where it would succeed before. I'm not sure how to quantify the risks here but we could consider adding more test cases.

[macladson]

I believe now that we are using pure Rust, we no longer rely on the Apple Security Framework and so can support OpenSSL v3 even on MacOS

[ackintosh]

Looks good to me!

[michaelsproul]

Can we add openssl to the list of banned crates here?

lighthouse/deny.toml

Lines 7 to 19 in edba56b

	deny = [
	{ crate = "ethers", reason = "legacy Ethereum crate, use alloy instead" },
	{ crate = "ethereum-types", reason = "legacy Ethereum crate, use alloy-primitives instead" },
	{ crate = "protobuf", reason = "use quick-protobuf instead" },
	{ crate = "derivative", reason = "use educe or derive_more instead" },
	{ crate = "ark-ff", reason = "present in Cargo.lock but not needed by Lighthouse" },
	{ crate = "strum", deny-multiple-versions = true, reason = "takes a long time to compile" },
	{ crate = "reqwest", deny-multiple-versions = true, reason = "takes a long time to compile" },
	{ crate = "aes", deny-multiple-versions = true, reason = "takes a long time to compile" },
	{ crate = "sha2", deny-multiple-versions = true, reason = "takes a long time to compile" },
	{ crate = "pbkdf2", deny-multiple-versions = true, reason = "takes a long time to compile" },
	{ crate = "scrypt", deny-multiple-versions = true, reason = "takes a long time to compile" },
	]

[pawanjay176]

LGTM. The web3 signer tests pass so seem like this is good to go.

[dapplion]

LGTM

[mergify]

Merge Queue Status

Rule: default

---

• ✅ Entered queue — 2026-02-10 01:38 UTC
• ✅ Checks passed · on draft merge queue: embarking unstable (0c9f97f) and #8768 together #8782
• ✅ Merged — 2026-02-10 02:10 UTC · at b33ebbc8626e70c43df47abb17e9141cfb1d2051

This pull request spent 31 minutes 52 seconds in the queue, including 30 minutes 41 seconds running CI.

Required conditions to merge

• check-success=local-testnet-success
• check-success=test-suite-success