/**
 * Certificate verification for enclave TLS certificates.
 *
 * Verifies that:
 * 1. Certificate is valid for the expected domain
 * 2. Certificate SANs contain the correct HPKE key
 * 3. Certificate SANs contain the correct attestation hash
 */
import type { AttestationDocument } from './types.js';
export interface CertVerificationResult {
    /** HPKE public key extracted from certificate (hex) */
    hpkePublicKey: string;
    /** Attestation document hash extracted from certificate (hex) */
    attestationHash: string;
    /** DNS names from certificate SANs */
    dnsNames: string[];
}
/**
 * Verify enclave TLS certificate.
 *
 * @param certPem - PEM-encoded certificate
 * @param expectedDomain - Expected domain name
 * @param attestationDoc - Attestation document to verify hash against
 * @param expectedHpkeKey - Expected HPKE public key (hex)
 * @returns Verification result with extracted values
 * @throws AttestationError if certificate parsing or decoding fails
 * @throws AttestationError if certificate values don't match expected values
 */
export declare function verifyCertificate(certPem: string, expectedDomain: string, attestationDoc: AttestationDocument, expectedHpkeKey: string): Promise<CertVerificationResult>;
//# sourceMappingURL=cert-verify.d.ts.map