X509Certificate's DN: any parser available in some commonly used lib?

Question

Again, the question arises how to fetch the CN from a subject's DN.

Some propose to break down the DN "by hand". However, I always wonder what happens when stuff like ",", "=", "CN=" is part of the right hand (value) side.... is that even allowed?

What is the most reliable and sane method to fetch the CN from a DN using Java and maybe BouncyCastle? Aren't there "String getAttribute(String)" methods? I just read part of https://www.ietf.org/rfc/rfc1779.txt and it defines proper "escaping" of the critical characters. Are there any RFC1779 parsers around? I found https://github.com/apache/cordova-android/blob/master/framework/src/com/squareup/okhttp/internal/tls/DistinguishedNameParser.java for example. Isn't there anything useful packed with BC, Java SE, or maybe in another maven module?

Answer 1

The solution is to use

new javax.naming.ldap.LdapName(
    X509Certificate.getSubjectX500Principal().getName())
    .getRdns()

Hint: RFC2253