code: func getDN(name *pkix.Name) string {
  	r := name.ToRDNSequence()
  	s := ""
  	for i := 0; i < len(r); i++ {
  		rdn := r[len(r)-1-i]
  		if i > 0 {
  			s += ","
  		}
  		for j, tv := range rdn {
  			if j > 0 {
  				s += "+"
  			}
  			typeString := tv.Type.String()
  			typeName, ok := attributeTypeNames[typeString]
  			if !ok {
  				derBytes, err := asn1.Marshal(tv.Value)
  				if err == nil {
  					s += typeString + "=#" + hex.EncodeToString(derBytes)
  					continue // No value escaping necessary.
  				}
  				typeName = typeString
  			}
  			valueString := fmt.Sprint(tv.Value)
  			escaped := ""
  			begin := 0
  			for idx, c := range valueString {
  				if (idx == 0 && (c == ' ' || c == '#')) ||
  					(idx == len(valueString)-1 && c == ' ') {
  					escaped += valueString[begin:idx]
  					escaped += "\\" + string(c)
  					begin = idx + 1
  					continue
  				}
  				switch c {
  				case ',', '+', '"', '\\', '<', '>', ';':
  					escaped += valueString[begin:idx]
  					escaped += "\\" + string(c)
  					begin = idx + 1
  				}
  			}
  			escaped += valueString[begin:]
  			s += typeName + "=" + escaped
  		}
  	}
  	return s
  }
docs: // Get the DN (distinguished name) associated with a pkix.Name.
  // NOTE: This code is almost a direct copy of the String() function in
  // https://go-review.googlesource.com/c/go/+/67270/1/src/crypto/x509/pkix/pkix.go#26
  // which returns a DN as defined by RFC 2253.