Add pfx HTTPS option

readme.md

@@ -985,6 +985,18 @@ Type: `string`
 
 The passphrase to decrypt the `options.https.key` (if different keys have different passphrases refer to `options.https.key` documentation).
 
+##### https.pfx
+
+Type: `string | Buffer | (string | Buffer | object)[]`
+
+PFX or PKCS12 encoded private key and certificate chain. `pfx` is an alternative to providing `options.https.key` and `options.https.certificate` individually. PFX is usually encrypted, if it is, `options.https.passphrase` will be used to decrypt it.
+
+Multiple PFX can be be provided as an array of unencrypted buffers or an array of objects like:
+
+`{buf: <string|buffer>[, passphrase: <string>]}`
+
+If the provided buffers are encrypted, `object.passphrase` can be used to decrypt them. If `object.passphrase` is not provided, `options.https.passphrase` will be used for decryption.
+
 ##### Examples for `https.key`, `https.certificate` and `https.passphrase`
 
 ```js

source/core/index.ts

@@ -187,6 +187,7 @@ export interface HTTPSOptions {
 	key?: SecureContextOptions['key'];
 	certificate?: SecureContextOptions['cert'];
 	passphrase?: SecureContextOptions['passphrase'];
+	pfx?: SecureContextOptions['pfx'];
 }
 
 interface NormalizedPlainOptions extends PlainOptions {
@@ -684,6 +685,7 @@ export default class Request extends Duplex implements RequestEvents<Request> {
 			assert.any([is.string, is.object, is.array, is.undefined], options.https.key);
 			assert.any([is.string, is.object, is.array, is.undefined], options.https.certificate);
 			assert.any([is.string, is.undefined], options.https.passphrase);
+			assert.any([is.string, is.array, is.undefined], options.https.pfx);
 		}
 
 		// `options.method`
@@ -975,6 +977,10 @@ export default class Request extends Duplex implements RequestEvents<Request> {
 			deprecationWarning('"options.passphrase" was never documented, please use "options.https.passphrase"');
 		}
 
+		if ('pfx' in options) {
+			deprecationWarning('"options.pfx" was never documented, please use "options.https.pfx"');
+		}
+
 		// Other options
 		if ('followRedirects' in options) {
 			throw new TypeError('The `followRedirects` option does not exist. Use `followRedirect` instead.');
@@ -1527,6 +1533,10 @@ export default class Request extends Duplex implements RequestEvents<Request> {
 			if (options.https.passphrase) {
 				requestOptions.passphrase = options.https.passphrase;
 			}
+
+			if (options.https.pfx) {
+				requestOptions.pfx = options.https.pfx;
+			}
 		}
 
 		try {

test/https.ts

@@ -159,6 +159,25 @@ test.serial('non-deprecated `rejectUnauthorized` option', withServer, async (t,
 	t.pass();
 });
 
+test.serial('non-deprecated `pfx` option', withServer, async (t, server, got) => {
+	server.get('/', (_request, response) => {
+		response.end('ok');
+	});
+
+	(async () => {
+		const warning = await pEvent(process, 'warning');
+		t.not(warning.name, 'DeprecationWarning');
+	})();
+
+	await got.secure({
+		https: {
+			pfx: 'fake-pfx'
+		}
+	});
+
+	t.pass();
+});
+
 test.serial('no double deprecated warning', withServer, async (t, server, got) => {
 	server.get('/', (_request, response) => {
 		response.end('ok');