The last valid DN test is this: 1.1.1= // empty value [AoO] 300A31083006060229011300 [AoO] Section 2.4 says that when the numeric oid form is used for the attribute value, then the value is #<ber-octets>. It would be less confusing if this example were changed to either of these: CN= // empty value 2.5.4.3=#1300 // empty PrintableString value