code: public void setSubject(byte[] subjectDN) throws IOException {
          try {
              subject = (subjectDN == null ? null : new X500Principal(subjectDN));
          } catch (IllegalArgumentException e) {
              throw new IOException("Invalid name", e);
          }
      }
docs: Sets the subject criterion. The specified distinguished name
  must match the subject distinguished name in the
  {@code X509Certificate}. If {@code null}, any subject
  distinguished name will do.
  <p>
  If {@code subjectDN} is not {@code null}, it should contain a
  single DER encoded distinguished name, as defined in X.501. For the ASN.1
  notation for this structure, see
  {@link #setIssuer(byte [] issuerDN) setIssuer(byte [] issuerDN)}.
  
  @param subjectDN a byte array containing the distinguished name in
  ASN.1 DER format (or {@code null})
  @throws IOException if an encoding error occurs (incorrect form for DN)