X509Certificate: what is the difference between getIssuerDN() and getSubjectDN() methods

Question

I'm using X509Certificate class in java, and when I want to get the subject name I try:

x509certificate.getIssuerDN().getName();

and

x509certificate.getSubjectDN().getName();

both methods have the same result. So what is the difference between them ??

Answer 1

This methods reads from two different fields in certificate. It may returns the same result in your case but not in common.

Please refer to getIssuerDN() and getSubjectDN().

Answer 2

The method public abstract Principal getIssuerDN() Denigrated, replaced by getIssuerX500Principal(). Returns the issuer as an implementation specific Principal object, which should not be relied upon by portable code. Gets the issuer (issuer distinguished name) value from the certificate. The issuer name identifies the entity that signed (and issued) the certificate.

The issuer name field contains an X.500 distinguished name (DN).

The Name describes a hierarchical name composed of attributes, such as country name, and corresponding values, such as US. The type of the AttributeValue component is determined by the AttributeType; in general it will be a directoryString. A directoryString is usually one of PrintableString, TeletexString or UniversalString.

Returns: a Principal whose name is the issuer distinguished name.

The method public abstract Principal getSubjectDN() Denigrated, replaced by getSubjectX500Principal(). Returns the subject as an implementation specific Principal object, which should not be relied upon by portable code. Gets the subject (subject distinguished name) value from the certificate. If the subject value is empty, then the getName() method of the returned Principal object returns an empty string ("").

See getIssuerDN for Name and other relevant definitions.

Returns: a Principal whose name is the subject name.