CERT_EXPIRY_GRACE
if ((uint64_t)now > (cert->cert->valid_before + CERT_EXPIRY_GRACE))
n = (CERT_EXPIRY_GRACE + cert->cert->valid_before) - (uint64_t)now;