First, it calls Locate withÂCertificateSerialNumber equal toÂ020900d2f5bad76a5ac8f9, and it's supposed to succeed.
Then, it callsÂGetAttributes which returnsÂCertificateSerialNumber equal toÂ00d2f5bad76a5ac8f9.
I understand that it's supposed to be the DER encoding of the field. But the first is the whole DER-encoded INTEGER, while the second is only the value of the ASN.1 tag.
Which one is supposed to be correct? I think this should be clarified in the next spec update.