pub fn leaf_expiry(
chain: &[CertificateDer<'_>],
) -> Result<OffsetDateTime, CertError>Expand description
The leaf certificate’s notAfter, read straight from the DER rather than
trusted from whatever ACME or storage claims — the certificate is the one
party that cannot lie about its own expiry.