Update pDNs Requirements:

- Issuer and Subject fields must have matching DCs of equal order
- "Visible domain name" is defined as domain described by "issuer" field DCs

Author: bitfl0wer

docs/Protocol Specifications/core.md

@@ -165,7 +165,8 @@ host.
 polyproto servers can be hosted under a domain name different from the domain name
 appearing on ID-Certs managed by that server **if all the following conditions are met:**
 
-1. Define the "*visible domain name*" as the domain name visible on an ID-Cert.
+1. Define the "*visible domain name*" as the domain name described by the [polyproto distinguished name](#6111-polyproto-distinguished-name-pdn)
+   of the "issuer" field on an ID-Cert.
 2. Define the "*actual domain name*" as the domain name where the polyproto server is actually hosted
    under.
 3. The *visible domain name* **must** have a URI `[visible domain name]/.well-known/polyproto-core`,
@@ -1035,7 +1036,7 @@ client.
 An ID-CSR includes the following information, according to the X.509 standard:
 
 - The public identity key of the client.
-- A polyproto Distinguished Name (`pDN`) "subject name", describing the actor the certificate is
+- A polyproto Distinguished Name (`pDN`) "subject", describing the actor the certificate is
   issued to. The `pDN` must be formatted according to [Section 6.1.1.1](#6111-polyproto-distinguished-name-pdn).
 - The signature algorithm used to sign the certificate.
 - The signature of the certificate, generated by using the entities' private identity key.
@@ -1082,14 +1083,17 @@ ID-Certs have the following structure:
 | The session ID of the client.                                                                       | No two valid certificates for one session ID can exist. Session IDs have to be unique per actor. | Subject Unique Identifier                                |
 | Extensions                                                                                          | [Extensions and Constraints](#6112-extensions-and-constraints)                                   | Extensions                                               |
 
+The domain components (`dc`) in the "issuer" and "subject" fields must be equal and in the same order.
+A certificate may not be treated as valid otherwise. X.509 semantics describing the correct ordering
+of domain components apply.
+
 ##### 6.1.1.1 polyproto Distinguished Name (`pDN`)
 
 polyproto Distinguished Names (`pDNs`) are a subset of an X.509 certificate's [distinguished
 Names (`DNs`)](https://ldap.com/ldap-dns-and-rdns/), defined by the LDAP Data Interchange Format (LDIF).
 The `DN` is a sequence of [relative distinguished names (`RDNs`)](https://ldap.com/ldap-dns-and-rdns/).
 
-The identity descriptor must be unique for each certificate issued by a home server. A `pDN`
-must meet all the following requirements:
+A `pDN` must meet all the following requirements:
 
 - If the `pDN` describes an actor, it must have a "common name" attribute. The
   common name must be the [local name](#5-federation-ids-fids) of the actor. In the case of an actor