code: private static X500Principal getX500Principal(X509Certificate cert,
              boolean getIssuer) throws Exception {
          byte[] encoded = cert.getEncoded();
          DerInputStream derIn = new DerInputStream(encoded);
          DerValue tbsCert = derIn.getSequence(3)[0];
          DerInputStream tbsIn = tbsCert.data;
          DerValue tmp;
          tmp = tbsIn.getDerValue();
          // skip version number if present
          if (tmp.isContextSpecific((byte)0)) {
            tmp = tbsIn.getDerValue();
          }
          // tmp always contains serial number now
          tmp = tbsIn.getDerValue();              // skip signature
          tmp = tbsIn.getDerValue();              // issuer
          if (getIssuer == false) {
              tmp = tbsIn.getDerValue();          // skip validity
              tmp = tbsIn.getDerValue();          // subject
          }
          byte[] principalBytes = tmp.toByteArray();
          return new X500Principal(principalBytes);
      }
docs: Extract the subject or issuer X500Principal from an X509Certificate.
  Parses the encoded form of the cert to preserve the principal's
  ASN.1 encoding.