Why is this?
This is because what OpenSSL returns. Apache HTTPD does the same because it also uses OpenSSL.
Which one matches LDAP RFC?
The one you call "standard order." However, this is an SSL certificate and SSL API. It has nothing to do with LDAP, and there is no reason why it should comply with any LDAP RFC. This is just another way of providing the DN of the certificate object. This is determined by X.509, not LDAP (although they are ultimately all defined by X.500, at least initially).
Is there a Java library for converting back and forth (from reverse, not reverse).
Disable the topic, not what I know, but easy enough to write:
public class OpenSSLSubjectName { private String name; public OpenSSLSubjectName(String name) { this.name = name; } public String getX500Name() throws NamingException { return getLdapName().toString(); } public LdapName getLdapName() throws NamingException { List<Rdn> rdns = new LinkedList<>(); String[] parts = name.split("/"); for (int i = 1; i < parts.length; i++) { rdns.add(new Rdn(parts[i])); } return new LdapName(rdns); } }
E & O.E.