#pragma once
#include "uefi.h"

#define X509_MAX_CERT_SIZE 2048
#define X509_MAX_CHAIN     4

struct x509_cert {
    uint8_t  raw[X509_MAX_CERT_SIZE];
    uint32_t raw_len;

    /* Subject public key (uncompressed point: 04 || X || Y) */
    uint8_t  pubkey[64];

    /* Signature algorithm */
    uint8_t  sig_algo[16]; /* OID bytes */
    uint32_t sig_algo_len;

    /* Signature value */
    uint8_t  sig_r[32];
    uint8_t  sig_s[32];

    /* Issuer & Subject (DER encoded, raw) */
    uint8_t  *issuer_dn;
    uint32_t issuer_dn_len;
    uint8_t  *subject_dn;
    uint32_t subject_dn_len;

    /* TBS (to-be-signed) portion */
    uint8_t  *tbs;
    uint32_t tbs_len;
};

/* Parse a DER-encoded X.509 certificate */
int x509_parse_cert(const uint8_t *der, uint32_t len, struct x509_cert *out);

/* Validate certificate chain (leaf -> intermediate -> root) */
int x509_validate_chain(struct x509_cert *chain, int count);

/* Get embedded ISRG Root X1 public key */
const uint8_t *x509_get_isrg_root_x1_key(void);
