Compute DER generalized time conversion in uint64_t and clamp to the
local time_t range before returning. This avoids wrapping far-future
ASN.1 times on 32-bit time_t platforms. We do not address time_t
being a non-integral type.
We must switch to OpenSSL 3.x, and getting lib/hcrypto to provide
OpenSSL 3.x APIs is too large an undertaking. Plus the hcrypto backend
is not safe, not secure (probably has timing leaks galore), and no one
has the resources to make it a world-class crypto library, so it just
has to go.
Roland C. Dowdeswell