[nox]

SslRef::set_certificate_der_unchecked and SslContextBuilder::set_certificate_der_unchecked wrap SSL_use_certificate_ASN1 and SSL_CTX_use_certificate_ASN1. Their names make explicit that they do not fully parse X.509 fields, while BoringSSL copies the input DER and validates enough structure to extract a supported public key.

This supports negative handshake tests that need to send certificate DER which X509::from_der rejects.

The impl of AsRef<Asn1StringRef> for Asn1TimeRef lets callers inspect encoded time bytes without direct boring-sys calls.

Tests cover both setters, malformed certificate DER, and the time-ref conversion.

[clanky-the-clanker]

✅ Approved — No issues found: the FFI wrappers match BoringSSL's argument orders, the time-to-string cast is sound, and the tests cover both setters.

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

📋 Code Quality: ✅ LGTM

No code issues. Both FFI wrappers pass the DER pointer and length in the order BoringSSL expects, which is different for the two functions. The AsRef cast is sound because ASN1_TIME is a typedef of ASN1_STRING.

---

📝 Documentation: ✅ LGTM

The doc comments accurately describe the limited validation and steer callers toward X509::from_der plus set_certificate for normal use.

---

_{Reviewed commit: 50e59235}