keytool uses issuerDN==subjectDN to build a cert chain and check if a cert is self-signed. Sometimes a cert is self-issued but not self-signed, more checks are needed to make sure the issuer *is* the subject.