GeezerVison

This loads the private key with full RSA validation on every call of _read_cert_and_key_files, including the success path. That validation is expensive, holds the GIL, and doesn't act as a gate here.

Cost (cryptography 46.0.7, OpenSSL 3.6.5, per check): RSA-2048 ~41 ms, RSA-4096 ~286 ms, EC P-256 ~0.06 ms. Agent-identity pools are fixed to ECDSA P-256, but RSA keys are documented for this path: the X.509 Workload Identity Federation setup guide generates rsa:2048 keys, and managed workload identity pools accept keyAlgorithm: RSA_2048/3072/4096. For those users the cost is paid on every configure_mtls_channel, every 401 on an mTLS endpoint (an ordinary expired-token 401 with an unchanged RSA-2048 pair went from ~1 ms to ~44 ms), and every SslCredentials.ssl_credentials access. Because the GIL is held, the aio transport's asyncio.to_thread hand-off doesn't protect the event loop (~42 ms stall per call in my test).

Not a gate: if validation fails, the ValueError is caught below and treated as "can't inspect, skip the check". I built an RSA key with valid n/e and corrupted private values: paired with an unrelated certificate, this function reports no mismatch and the mismatched pair is returned. ssl.load_cert_chain also accepts that key, so the TLS layer never ran this validation before this change either.

Since only the public half is compared, suggest skipping the validation where the installed library supports it (needs import inspect):

# Only the key's public half is compared, so skip RSA private-key validation
# where supported: it is slow (~40 ms for RSA-2048) and the TLS layer does not
# perform it either.
try:
    _SKIP_RSA_VALIDATION_SUPPORTED = (
        "unsafe_skip_rsa_key_validation"
        in inspect.signature(serialization.load_pem_private_key).parameters
    )
except (TypeError, ValueError):
    _SKIP_RSA_VALIDATION_SUPPORTED = False
_KEY_MATCH_LOAD_KWARGS = (
    {"unsafe_skip_rsa_key_validation": True} if _SKIP_RSA_VALIDATION_SUPPORTED else {}
)
...
        key_public_key = serialization.load_pem_private_key(
            key, password=None, **_KEY_MATCH_LOAD_KWARGS
        ).public_key()

I applied this to a copy of the branch:

• The seven new tests still pass.
• Matching and mismatched RSA/EC pairs, the two-certificate chain, a mismatch that heals after one sleep, encrypted keys and garbage bodies behave exactly as before.
• The corrupted-key mismatch is now caught.
• An RSA-2048 check drops from ~41 ms to ~0.03 ms.

The try/except matters because load_pem_private_key is a compiled function whose inspectable signature depends on how the library was built; without it, a version where inspect.signature raises would fail at import. Older cryptography versions without the option, or where its signature can't be inspected, keep today's behaviour. If you'd rather avoid the unsafe_ option, reading n/e with pyasn1 (already a dependency) also works, at ~0.1–0.2 ms per check.

The retry only covers "both files parse but the keys differ". These two reads are outside any try, so an OSError or the PEM-format ClientCertError from _extract_cert_chain / _extract_private_key leaves the loop on the first attempt with no sleep and no re-read.

A rotator that truncates and rewrites in place, or unlinks and recreates, produces an empty, partial, or missing file in the same window that produces a mismatched pair. I reproduced each of those states against this function: all raise immediately, even when the file would be valid again by the first sleep. Rotators that swap atomically never hit this.

Not a regression, but the docstring justifies the loop by rotation, so it seems worth covering. Sketch (I ran this against the branch for healing, permanent-failure and mixed cases):

last_exc = None
for attempt in range(_CERT_KEY_MATCH_MAX_ATTEMPTS):
    if attempt:
        time.sleep(_CERT_KEY_MATCH_RETRY_INTERVAL)
    try:
        cert_data = _read_cert_file(cert_path)
        key_data = _read_key_file(key_path)
    except (OSError, exceptions.ClientCertError) as exc:
        last_exc = exc
        continue
    last_exc = None
    if not _has_cert_key_mismatch(cert_data, key_data):
        return cert_data, key_data
    ...

if last_exc is not None:
    raise last_exc
raise exceptions.ClientCertError(...)

Trade-off: a permanently missing or malformed file then takes 0.2 s to raise. The existing failure tests in TestReadCertAndKeyFile (test_no_cert_file, test_no_key_file, test_invalid_cert_file, test_invalid_key_file, test_multiple_keys_raises_error, test_truncated_multi_cert_raises_error) would still pass but each sleep for real unless time.sleep is patched.

This only rewrites the key file during the wait, so nothing pins that the certificate is re-read too. Hoisting _read_cert_file(cert_path) out of the loop still passes all seven new cases (I checked by mutation).

Rotation can land in either order. Suggest parametrizing on which file catches up, or adding a sibling case: start with a stale certificate and the new key, and have the side effect write the matching certificate to cert.pem.

x509.InvalidVersion derives from Exception only, so it is not caught here. A certificate with an invalid version field makes this function raise instead of returning False as the docstring says, while ssl.load_cert_chain accepts the same pair. Unlikely in practice, but a one-token fix: