pub fn subject_cn_of_leaf(cert: &CertificateDer<'_>) -> Option<String>Expand description
Extract the subject CommonName of a leaf certificate (#124): the
value of the FIRST CN attribute (OID 2.5.4.3) in the subject RDN
sequence, decoded from UTF8String / PrintableString / IA5String (the
string types CNs carry in practice). The decode is STRICT UTF-8:
invalid CN bytes yield None rather than being lossy-folded to
U+FFFD, which could collide two distinct malformed names into one
selector. None also when the subject carries no CN at all — either
way such a certificate can only match a by-fingerprint mTLS
credential (the caller falls back to the fingerprint selector).
Hand-rolled DER walk (no X.509 parser dependency), same substrate as
the private SPKI extractor in this module. THE CERTIFICATE IS
ALREADY VERIFIED at the TLS layer when this runs; extraction only
reads the match value.