public static CA readCA(final String pemFileContent, final String keyPassword) throws CACreationException {
        try (var bundleReader = new StringReader(pemFileContent)) {
            PEMParser pemParser = new PEMParser(bundleReader);
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");

            var certificates = new ArrayList<Certificate>();
            PrivateKey privateKey = null;

            var pemObjects = readPemObjects(pemParser);
            for (var pemObject : pemObjects) {
                if (pemObject instanceof X509Certificate cert) {
                    certificates.add(cert);
                } else if (pemObject instanceof X509CertificateHolder cert) {
                    certificates.add(new JcaX509CertificateConverter().getCertificate(cert));
                } else if (pemObject instanceof PKCS8EncryptedPrivateKeyInfo encryptedPrivateKey) {
                    if (keyPassword == null || keyPassword.isBlank()) {
                        throw new CACreationException("Private key is encrypted, but no password was supplied!");
                    }
                    var decryptorBuilder = new JceOpenSSLPKCS8DecryptorProviderBuilder().setProvider("BC");
                    var keyDecryptorBuilder = decryptorBuilder.build(keyPassword.toCharArray());

                    var privateKeyInfo = encryptedPrivateKey.decryptPrivateKeyInfo(keyDecryptorBuilder);
                    privateKey = converter.getPrivateKey(privateKeyInfo);
                } else if (pemObject instanceof PrivateKeyInfo privateKeyInfo) {
                    privateKey = converter.getPrivateKey(privateKeyInfo);
                }
            }

            if (privateKey == null) {
                throw new CACreationException("No private key supplied in CA bundle!");
            }
            if (certificates.isEmpty()) {
                throw new CACreationException("No certificate supplied in CA bundle!");
            }

            return new CA(certificates, privateKey);
        } catch (PKCSException e) {
            throw new CACreationException("Error while decrypting private key. Wrong password?", e);
        } catch (CertificateException | IOException | OperatorCreationException e) {
            throw new CACreationException("Failed to parse CA bundle: ", e);
        }
    }
@Test
    void throwsExceptionIfKeyIsEncryptedAndPasswordIsWrong() throws Exception {
        assertThatThrownBy(() -> PemCaReader.readCA(PEM_CERT_WITH_ENCRYPTED_KEY, "wrong!"))
                .isInstanceOf(CACreationException.class)
                .hasMessage("Error while decrypting private key. Wrong password?");
    }