crypto/x509: DN OU ordering

[rikkuness]

What version of Go are you using (go version)?

$ go version
go version go.1.11.1 linux/amd

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
linux amd64

What did you do?

When getting the subject of a certificate through cert.Subject.String(), where the DN has multiple OU's, the OU's are in a backwards order and joined with a '+'

https://play.golang.org/p/hKtL6TEeln5

What did you expect to see?

CN=Example User,OU=Upper,OU=Lower,O=My Org,C=GB

What did you see instead?

CN=Example User,OU=Lower+OU=Upper,O=My Org,C=GB

[agnivade]

/cc @FiloSottile

[mengzhuo]

When getting the subject of a certificate through cert.Subject.String(), where the DN has multiple OU's, the OU's are in a backwards order and joined with a '+'

It's a multi-valued RDN described in RFC2253 section 2.
https://www.ietf.org/rfc/rfc2253.txt

[rikkuness]

Interesting, so it's technically a valid RDN as per the RFC, the frustration I guess is that I can't just feed that straight then into gopkg.in/ldap.v2 to retrieve that object. Whereas say in nginx, nodejs etc. querying the subject string I'd get a DN that I could lookup in LDAP.

Am I misunderstanding the use of a multivalue? It seems to suggest that in this case the OU could be either one or the other where in the directory it's actually a nested OU and as such has a fixed order.