diff --git a/src/lib/x509/cert_status.cpp b/src/lib/x509/cert_status.cpp
index b9669bcf942..7e74e692d90 100644
--- a/src/lib/x509/cert_status.cpp
+++ b/src/lib/x509/cert_status.cpp
@@ -33,6 +33,8 @@ const char* to_string(Certificate_Status_Code code) {
          return "Trusted certificate has expired";
       case Certificate_Status_Code::OCSP_ISSUER_NOT_TRUSTED:
          return "OCSP issuer is not trustworthy";
+      case Certificate_Status_Code::EMPTY_DIRECTORYNAME:
+         return "DirectoryName was empty";
 
       case Certificate_Status_Code::NO_REVOCATION_DATA:
          return "No revocation data";
diff --git a/src/lib/x509/pkix_enums.h b/src/lib/x509/pkix_enums.h
index 689b24a6cb9..ab6d8b9eceb 100644
--- a/src/lib/x509/pkix_enums.h
+++ b/src/lib/x509/pkix_enums.h
@@ -37,6 +37,7 @@ enum class Certificate_Status_Code : uint16_t {
    OCSP_SERVER_NOT_AVAILABLE = 503,
    TRUSTED_CERT_HAS_EXPIRED = 504,
    TRUSTED_CERT_NOT_YET_VALID = 505,
+   EMPTY_DIRECTORYNAME = 506,
 
    // Errors
    FIRST_ERROR_STATUS = 1000,
diff --git a/src/lib/x509/x509path.cpp b/src/lib/x509/x509path.cpp
index fee1a07d553..d35bda2d81d 100644
--- a/src/lib/x509/x509path.cpp
+++ b/src/lib/x509/x509path.cpp
@@ -375,8 +375,12 @@ CertificatePathStatusCodes PKIX::check_chain(const std::vector<X509_Certificate>
 
       for(const auto& rdn : subject.subject_dn().rdns()) {
          for(const auto& ava : rdn) {
+            const size_t dn_len = ava.second.size();
             const size_t dn_ub = X509_DN::lookup_ub(ava.first);
-            if(dn_ub > 0 && ava.second.size() > dn_ub) {
+            if(dn_len == 0) {
+               // RFC 5280 DirectoryStrings are supposed to be non-empty
+               status.insert(Certificate_Status_Code::EMPTY_DIRECTORYNAME);
+            } else if(dn_ub > 0 && dn_len > dn_ub) {
                status.insert(Certificate_Status_Code::DN_TOO_LONG);
             }
          }