[misiektoja]

Description

prepare_cert_template and prepare_cert_template_from_csr now copy the issuer and subject Name objects instead of converting them to an OpenSSL-style string and back. A Name passed by the caller is copied too, so changing the template does not change the source.

Motivation and Context

get_openssl_name_notation writes the RDNs in DER order, but parse_common_name_from_str reads the string as RFC 4514, which starts with the last RDN. The round trip reverses a multi-RDN name such as C=DE,O=Example,CN=Issuing CA, splits multi-valued RDNs and changes the string types. An rr built from such a certificate then names no certificate (RFC 9483 Section 4.2) and the CA answers badCertId.

How Has This Been Tested?

New unit tests compare the name DER for multi-RDN certificates, CSRs and an rr built from such a certificate. Another test changes the template issuer and checks that the Name passed in stays unchanged. These fail on main and pass with this change. A last test checks that changing the template does not change the certificate. It passes on main too, because main built new names from the text. Other unit test results match main. Python 3.15 with pytest 9.2.