fix(attestation): include Azure vTPM AK intermediates

[samlaf]

This fixes Azure TDX/vTPM attestation verification failures caused by newer Azure vTPM AK certificate chains that are not covered by the currently bundled Global Virtual TPM CA - 03 intermediate.

On a current Azure TDX CVM, the AK leaf certificate chain can look like:

AK leaf
  issuer: Azure Cloud Virtual TPM CA - 24

Azure Cloud Virtual TPM CA - 24
  issuer: Azure Cloud Virtual TPM CA 2025

Azure Cloud Virtual TPM CA 2025
  issuer: Azure Virtual TPM Root Certificate Authority 2023

The TPM NV AK cert index on this VM contained only:

leaf DER || zero padding

so parsing additional intermediates from the TPM AK cert payload is not sufficient for this chain.

This PR changes Azure attestation generation to fetch the AK issuer chain from the leaf certificate’s AIA CA Issuers URLs and serialize those intermediates into the attestation evidence. Verification remains offline: the verifier treats these intermediates as untrusted chain material and still pins the Azure vTPM roots.

Microsoft guidance indicates that AIA should be used to discover Azure vTPM intermediate CAs, since public docs can lag behind production intermediate rotation:

https://learn.microsoft.com/en-us/answers/questions/5897616/download-intermediate-ca-cert-for-azure-cloud-virt

Changes

• Adds optional evidence field:

  ak_intermediate_certificates_pem: Vec<String>

• During Azure attestation generation:

  • reads the AK leaf certificate from the vTPM;
  • strips TPM NV zero padding;
  • walks AIA CA Issuers URLs up to a bounded depth;
  • serializes fetched intermediate certs into the evidence.

• During verification:

  • deserializes evidence-supplied intermediates;
  • bounds the number of supplied intermediates;
  • combines them with the legacy bundled intermediate for backwards compatibility;
  • verifies the AK leaf against pinned Azure vTPM roots.

• Keeps verification network-free/deterministic.

• Keeps #[serde(default)] on the new field so old evidence still deserializes.

• Adds offline fixture tests for the observed Azure chain:

  • Azure Cloud Virtual TPM CA - 24
  • Azure Cloud Virtual TPM CA 2025

Security notes

The fetched intermediates are not trusted anchors. They are serialized as untrusted evidence only. Verification still requires the AK certificate chain to terminate at a pinned Azure vTPM root.

The number of evidence-supplied intermediates is capped to avoid unbounded peer-controlled chain material.

Behavior change

Azure attestation generation now makes outbound HTTP(S) requests to Microsoft PKI/AIA endpoints in order to fetch issuer certificates.

Azure attestation verification does not make network requests.

Validation

Tested with this code on an Azure Standard_DC4eds_v6 TDX box on westus3. Before this change, verification failed with:

WebPKI: UnknownIssuer

After this change:

Generating Azure TDX + vTPM attestation...
Generated azure-tdx evidence: 22148 bytes
Verifying Azure TDX + vTPM attestation...
Verification succeeded.

The generated evidence includes two serialized AK intermediates:

Azure Cloud Virtual TPM CA - 24
Azure Cloud Virtual TPM CA 2025

This subsumes #48.

PR #48 improves handling for cases where the TPM AK cert payload contains concatenated DER intermediates. However, on the Azure TDX VM tested here, the TPM AK cert NV index contained only:

leaf DER || zero padding

and no intermediate certificates. Therefore #48 does not fix the observed UnknownIssuer failure for this chain.

This PR handles that case by following the AIA issuer URLs from the AK leaf certificate and including the resulting issuer chain in the evidence.