pub fn decode_issuer_name(ca: &CaConfig) -> Result<Vec<u8>, String>
Decode the issuer DN (DER) for a CA, falling back to a synthetic CN=<label>.
CN=<label>