[Issue 9551] dnSubtreeMatch and others do not handle empty DN as asserted value