A PKCS #12 file is a PFX structure: authenticated safe contents holding bags (keyBag, pkcs8ShroudedKeyBag, certBag, crlBag, secretBag) with friendly names and local key ids, plus an integrity MAC derived from the password. RFC 9579 (2024) adds PBMAC1, which replaces the legacy PKCS #12-specific MAC key derivation with PBKDF2.
Algorithm defaults decide compatibility. OpenSSL 3.6.5 pkcs12 -export writes AES-256-CBC with PBKDF2 (2,048 iterations) for both certificates and keys and an HMAC-SHA-256 MAC; with -legacy it writes RC2-40 for certificates, 3DES for the key and an HMAC-SHA-1 MAC, which older Windows, macOS and Java versions require. Java has used PKCS #12 as its default keystore type since JDK 9.
Errors such as "mac verify failure" usually mean a wrong password, and "unsupported algorithm RC2-40-CBC" means a legacy file opened without OpenSSL's legacy provider. The PFX inspector lists bags and algorithms locally without exporting the key.