> In the same paragraph, the sentence before the one you're quoting says "If the subject field contains an empty sequence, then the issuing CA MUST include a subjectAltName extension that is marked as critical." > It's not possible to have a missing subject name in a certificate, the field is not OPTIONAL. You are of course correct. Thanks Erwann. (He has forgotten more about ASN1 than I ever knew :)