title: Why does Nginx Provide the Client SSL DN in reverse order?
body: <p>I'm curious why some web servers (eg. Nginx) provides the Client SSL DN in reverse order.</p>
  
  <p>A web app is posting the DN to a Java Web Service, which is attempting to create a Java <a href="http://docs.oracle.com/javase/7/docs/api/javax/naming/ldap/LdapName.html?is-external=true" rel="nofollow noreferrer">javax.naming.ldap.LdapName</a>.</p>
  
  <p>Standard Order (LDAP or X500Name):</p>
  
  <pre><code>"CN=Jimmy Blooptoop,OU=Someplace,OU=Employees,DC=Bloopsoft-Inc"
  </code></pre>
  
  <p>Reverse Order (OpenSSL Oneline Format) (What Nginx Returns as _$ssl_client_s_dn_):</p>
  
  <pre><code>"/DC=Bloopsoft-Inc/OU=Employees/OU=Someplace/CN=Jimmy Blooptoop"
  </code></pre>
  
  <p>Why is this?  </p>
  
  <p>Which one matches the LDAP RFC?</p>
  
  <p>Do they both?</p>
  
  <p><strong>Notes on LDAP RFC:</strong></p>
  
  <p>There are many RFC's related to LDAP: <a href="https://www.ldap.com/ldap-specifications-defined-in-rfcs" rel="nofollow noreferrer">https://www.ldap.com/ldap-specifications-defined-in-rfcs</a></p>
  
  <p>Many people references different ones, here is an attempt at a quick history of them:</p>
  
  <ul>
  <li><s>July 1993: RFC 1485 - A String Representation of Distinguished Names</s></li>
  <li><s>March 1995: RFC 1779 - A String Representation of Distinguished Names</s></li>
  <li>Dec 1997: RFC 2253 - Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names</li>
  <li>September 2002: RFC 3377 - Lightweight Directory Access Protocol (v3): Technical Specification (Updating RFC 2253)</li>
  <li><s>March 2003: RFC 3494 - Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status (Retiring RFC 1485, RFC 1779)</s></li>
  <li><strong>June 2006: RFC 4514</strong> - Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names </li>
  </ul>
  
  <p>Most Recent One, which obsoleted others:
  <a href="https://docs.ldap.com/specs/rfc4514.txt" rel="nofollow noreferrer">RFC 4514: Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names</a></p>
  
  <p><strong>Java Library:</strong></p>
  
  <p>Is there a Java library to convert back and forth (from reverse to not revers)?  LdapName throws an InvalidNameException.  Seems like there should be, the backwards format appears frequently.</p>
  
  <p><em>Java Libraries:</em></p>
  
  <ul>
  <li><a href="https://docs.oracle.com/javase/7/docs/api/javax/naming/ldap/LdapName.html" rel="nofollow noreferrer">javax.naming.ldap.LdapName</a>  Supports RFC 2253</li>
  <li><a href="https://directory.apache.org/api/gen-docs/latest/apidocs/org/apache/directory/api/ldap/model/filter/FilterEncoder.html" rel="nofollow noreferrer">org.apache.directory.api.ldap.model.filter.FilterEncoder</a> Supports RFC 4514</li>
  <li><a href="http://docs.spring.io/spring-ldap/docs/current/apidocs/org/springframework/ldap/support/LdapUtils.html" rel="nofollow noreferrer">Spring LdapUtils</a> Wraps LdapName</li>
  <li>Article on using BouncyCastle X509Name to parse and compre DN's: <a href="http://www.sivachandran.in/2012/11/comparing-x509-distinguished-name-with.html" rel="nofollow noreferrer">http://www.sivachandran.in/2012/11/comparing-x509-distinguished-name-with.html</a>  </li>
  </ul>
  
  <p><strong>Ngninx Notes:</strong></p>
  
  <ul>
  <li><a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html" rel="nofollow noreferrer">http://nginx.org/en/docs/http/ngx_http_ssl_module.html</a></li>
  </ul>
  
  <p>Linking: </p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/2914521/how-to-extract-cn-from-x509certificate-in-java">How to extract CN from X509Certificate in Java?</a></li>
  <li><a href="https://stackoverflow.com/questions/7933468/parsing-the-cn-out-of-a-certificate-dn">Parsing the CN out of a certificate DN</a> (Borrowed DN example from)</li>
  <li><a href="http://nategood.com/client-side-certificate-authentication-in-ngi" rel="nofollow noreferrer">Nginx Info</a></li>
  <li><a href="https://stackoverflow.com/questions/10871922/x500principal-distinguished-name-order">X500Principal Distinguished Name order</a></li>
  <li><a href="https://wiki.nikhef.nl/grid/How_to_handle_OpenSSL_and_not_get_hurt_background_information" rel="nofollow noreferrer">https://wiki.nikhef.nl/grid/How_to_handle_OpenSSL_and_not_get_hurt_background_information</a></li>
  <li><a href="https://www.openssl.org/docs/manmaster/apps/x509.html#item_oneline" rel="nofollow noreferrer">https://www.openssl.org/docs/manmaster/apps/x509.html#item_oneline</a></li>
  </ul>