In the [X.509 specification][1] it sais that the issuer name is to be signed. Since we verify the certificate with the authenticated issuer's public key, it seems infeasible to forge the issuer name anyways. A different issuer name would lead us to choose a different entities public key which would never match the signature. Could somebody please shed some light on this for me? [1]: https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2