client.EndorsementKeyRSA could panic

[jiaqi-beep]

We have encountered a case where EndorsementKeyRSA panics with following stack trace

time="2026-03-09T10:11:16+01:00" level=debug msg="Panic: interface conversion: interface is nil, not crypto.PublicKey"
time="2026-03-09T10:11:16+01:00" level=debug msg="Panic Stack Trace: goroutine 138 [running]: runtime/debug.Stack() \tC:/Program Files/go/src/runtime/debug/stack.go:26 +0x5e microsoft.com/azure/hybridagent/src/utils.StackDumpAfterPanic() \tC:/__w/1/s/src/utils/stackdump.go:20 +0x3a panic({0x11731c0?, 0xc00039a060?}) \tC:/Program Files/go/src/runtime/panic.go:791 +0x132 github.com/google/go-tpm-tools/client.(*Key).SetCert(0xc0003a7000?, 0x38c?) \tC:/Users/ContainerAdministrator/go/pkg/mod/github.com/google/go-tpm-tools@v0.4.5/client/keys.go:502 +0x13b github.com/google/go-tpm-tools/client.(*Key).trySetCertificateFromNvram(0xc0003e2120, 0x466a60?) \tC:/Users/ContainerAdministrator/go/pkg/mod/github.com/google/go-tpm-tools@v0.4.5/client/keys.go:526 +0x91 github.com/google/go-tpm-tools/client.EndorsementKeyRSA({0x152e1be6940, 0xc00004e660})

Type assertion fails when certificate.PublicKey is nil. However I am not sure why it would be nil after x509 certificate being successfully parsed

@jessieqliu This PR is related.

[jkl73]

first glance, looks like cert.public might not be populated if the Algo is unknown (https://github.com/golang/go/blob/d4ace6b007224ef71348f500f1515510bd2c282c/src/crypto/x509/parser.go#L1010)

Would you share what's the cert algorithm you are using?

but anyway this needs to be handled in the setcert logic

[jiaqi-beep]

Not sure at the moment. This would be the EK cert of TPM which should be provided by TPM manufacturer.

[jessieqliu]

Created #699 to add nil checks to the function.

[jkl73]

Not sure at the moment. This would be the EK cert of TPM which should be provided by TPM manufacturer.

There are some tools you can use to extract the ek cert (https://github.com/salrashid123/tpm2/blob/master/ek_cert_key/main.go or https://tpm2-tools.readthedocs.io/en/latest/man/tpm2_getekcertificate.1/)
If you know the manufacturer of the TPM, you can also try to check their spec.