java.security.cert.X509Certificate contains two methods
for retrieving the Subject DN from the certificate:

getSubjectDN
getSubjectX500Principal

neither document the correct behavior if the subject value
is empty. the above methods should document that
they will return java.security.Principal objects whose getName()
implementations return an empty string ("") if the subject
value is empty.