I’m using the Bouncycastle lib to generate certificates from PKCS10 requests using the X509v3CertificateBuilder class. It returns build a X509CertificateHolder object which contains the generated certificate. If I call getIssuer on the holder, it returns the issuer distinguished name in the correct order (the same returned if I call getSubjectX500Principal() on the issuer certificate), if I parse the encoded version