title: ASN.1 Octet Strings
body: <p>I'm decoding a X.509 Certificate in ASN.1 format. I'm decoding it successfully, traversing the structure, but there is one thing that I don't understand.</p>
  
  <p>There are some scenarios where I get an octet string and this website that I am playing with (<a href="http://lapo.it/asn1js/" rel="noreferrer">http://lapo.it/asn1js/</a>) shows that these octet strings actually contain more of the ASN.1 tree. This website annotates such octet strings with (encapsulates)</p>
  
  <p>My question is this: how do I know during parsing that an octet string actually encapsulates something more? Do I just try to parse it, looking if I get a tag and valid length? If not then it is pure bytes data? And if yes then it is a valid sub-tree?</p>
  
  <p>Or is this meant to be output as bytes and the consumer should then only try to parse it if he knows that it is encoded data from for certain keys?</p>
  
  <p>Take the example that is already loaded on the site and hit "decode". I am referring for example to offset 332 which is an octet string that encapsulates a bit string.</p>