Paul,
My point was exactly that the DER do not include any rules for
modifying the values of attributes, and the canonicalization you are
describing does involve such modification. Hence the question is
whether there can legitimately exist two distinct DNs that differ in
terms of, for example, capitalization, and which thus are equivalent
in terms of the directory serach rules, but which represent different
entries. If so, then it would be an error to use the search rules for
automatically select a certificate from a cache with an issuer DN that
is not exactly identical to the issuer DN in a received message, but
which does match under the search rules. In general, it would seem
dangerous to declare two DNs equivalent when they match under
search rules but really are not identical.
Steve