4 files changed, 26 insertions, 7 deletions
diff --git a/src/lib/x509/asn1_alt_name.cpp b/src/lib/x509/asn1_alt_name.cpp
index 8b3d2d6e9..04e11bbcd 100644
--- a/src/lib/x509/asn1_alt_name.cpp
+++ b/src/lib/x509/asn1_alt_name.cpp
@@ -98,6 +98,15 @@ bool AlternativeName::has_field(const std::string& attr) const
    return (range.first != range.second);
    }
 
+std::string AlternativeName::get_first_attribute(const std::string& attr) const
+   {
+   auto i = m_alt_info.lower_bound(attr);
+   if(i != m_alt_info.end() && i->first == attr)
+      return i->second;
+
+   return "";
+   }
+
 std::vector<std::string> AlternativeName::get_attribute(const std::string& attr) const
    {
    std::vector<std::string> results;
diff --git a/src/lib/x509/asn1_alt_name.h b/src/lib/x509/asn1_alt_name.h
index 81f933ea0..83ac215ba 100644
--- a/src/lib/x509/asn1_alt_name.h
+++ b/src/lib/x509/asn1_alt_name.h
@@ -29,6 +29,8 @@ class BOTAN_PUBLIC_API(2,0) AlternativeName final : public ASN1_Object
       bool has_field(const std::string& attr) const;
       std::vector<std::string> get_attribute(const std::string& attr) const;
 
+      std::string get_first_attribute(const std::string& attr) const;
+
       void add_attribute(const std::string& type, const std::string& value);
       void add_othername(const OID& oid, const std::string& value, ASN1_Tag type);
 
diff --git a/src/lib/x509/pkcs10.cpp b/src/lib/x509/pkcs10.cpp
index cdcb5e985..82ef0945d 100644
--- a/src/lib/x509/pkcs10.cpp
+++ b/src/lib/x509/pkcs10.cpp
@@ -80,6 +80,8 @@ std::unique_ptr<PKCS10_Data> decode_pkcs10(const std::vector<uint8_t>& body)
 
    BER_Object attr_bits = cert_req_info.get_next_object();
 
+   std::set<std::string> pkcs9_email;
+
    if(attr_bits.type_tag == 0 &&
       attr_bits.class_tag == ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC))
       {
@@ -94,7 +96,7 @@ std::unique_ptr<PKCS10_Data> decode_pkcs10(const std::vector<uint8_t>& body)
             {
             ASN1_String email;
             value.decode(email);
-            data->m_alt_name.add_attribute("RFC822", email.value());
+            pkcs9_email.insert(email.value());
             }
          else if(attr.oid == OIDS::lookup("PKCS9.ChallengePassword"))
             {
@@ -115,9 +117,16 @@ std::unique_ptr<PKCS10_Data> decode_pkcs10(const std::vector<uint8_t>& body)
 
    cert_req_info.verify_end();
 
-   // TODO pull AlternativeName out of extensions and merge with m_alt_name
+   if(auto ext = data->m_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>())
+      {
+      data->m_alt_name = ext->get_alt_name();
+      }
+
+   for(std::string email : pkcs9_email)
+      {
+      data->m_alt_name.add_attribute("RFC882", email);
+      }
 
-   
    return data;
    }
 
diff --git a/src/lib/x509/x509_dn.cpp b/src/lib/x509/x509_dn.cpp
index e705fe74d..d07344aae 100644
--- a/src/lib/x509/x509_dn.cpp
+++ b/src/lib/x509/x509_dn.cpp
@@ -100,10 +100,9 @@ std::string X509_DN::get_first_attribute(const std::string& attr) const
    {
    const OID oid = OIDS::lookup(deref_info_field(attr));
 
-   auto range = m_dn_info.equal_range(oid);
-
-   if(range.first != m_dn_info.end())
-      return range.first->second.value();
+   auto i = m_dn_info.lower_bound(oid);
+   if(i != m_dn_info.end() && i->first == oid)
+      return i->second.value();
 
    return "";
    }