crypto/x509: Incorrect TBSCertificateList.Issuer field when using non-pkix.Name-encodable Issuer [1.18 backport]

[sgmiller]

Issue to track potentially backporting an eventual CL for #53754

[toothrot]

Please consider adding rationale as per https://go.dev/wiki/MinorReleases.

[sgmiller]

Rationale for backporting is that this can allow CSRs to be generated which are not valid (mismatching subject) which has security implications to the revocation process. There is also no work-around, meaning no way to write a Go program that works with these certificates within a revocation list.

[heschi]

I'm going to close these backport issues for now; there's no point in us reviewing them until the original issue is fixed. Please ping them when that's done.