pub fn parse_ak_cert_metadata(
data: &[u8],
) -> Result<AkCertMetadata, AkCertMetadataError>Expand description
Extract renewal hints, not a certificate trust decision.
TPM NV storage can contain padding or stale bytes after the DER certificate. Only metadata and its enclosing structure are decoded. Algorithm parameters, public key/signature contents, non-CN attributes, non-AKI extension values, and individual AKI GeneralName contents are opaque, bounded DER values. Do not replace this with the full X.509 decoder: its owned certificate and GeneralNames machinery significantly increases the OpenHCL binary size.