code: public void setIssuer(byte[] issuerDN) throws IOException {
          try {
              issuer = (issuerDN == null ? null : new X500Principal(issuerDN));
          } catch (IllegalArgumentException e) {
              throw new IOException("Invalid name", e);
          }
      }
docs: Sets the issuer criterion. The specified distinguished name
  must match the issuer distinguished name in the
  {@code X509Certificate}. If {@code null} is specified,
  the issuer criterion is disabled and any issuer distinguished name will
  do.
  <p>
  If {@code issuerDN} is not {@code null}, it should contain a
  single DER encoded distinguished name, as defined in X.501. The ASN.1
  notation for this structure is as follows.
  <pre>{@code
  Name ::= CHOICE {
  RDNSequence }
  
  RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
  
  RelativeDistinguishedName ::=
  SET SIZE (1 .. MAX) OF AttributeTypeAndValue
  
  AttributeTypeAndValue ::= SEQUENCE {
  type     AttributeType,
  value    AttributeValue }
  
  AttributeType ::= OBJECT IDENTIFIER
  
  AttributeValue ::= ANY DEFINED BY AttributeType
  ....
  DirectoryString ::= CHOICE {
  teletexString           TeletexString (SIZE (1..MAX)),
  printableString         PrintableString (SIZE (1..MAX)),
  universalString         UniversalString (SIZE (1..MAX)),
  utf8String              UTF8String (SIZE (1.. MAX)),
  bmpString               BMPString (SIZE (1..MAX)) }
  }</pre>
  <p>
  Note that the byte array specified here is cloned to protect against
  subsequent modifications.
  
  @param issuerDN a byte array containing the distinguished name
  in ASN.1 DER encoded form (or {@code null})
  @throws IOException if an encoding error occurs (incorrect form for DN)