> I thought about escaping regarding DN itself (LDAP DN). Look up the -nameopt flag in, say, x509.pod Then if you need C code, trace through what apps/x509.c does.