From some private email between myself and Andreas:


==========
On second thought, the easiest fix would be to eliminate use of X500Name
altogether and use X500Principal instead. That solves the problem for
all providers that override the getSubject/IssuerX500Principal methods
in a sensible way (and is no worse than the current implementation for
those that don't).

The only problem is that this would not help for Merlin because the Sun
X509Certificate implementation does not override those methods yet. I
have filed that as bug 4530918.
=======
I would hope that in Hopper we can move everything to use X500Principal.
If somebody has a problem, we just tell him to use a provider that overrides
getSubject/IssuerX500Principal() (like the SUN provider).