I do get valid certificates from the lawyer.
For one of the certificates the signature is not validated!
The certificates seem to differ only in the way the DN is formed.
Here are the DN listed (data replaced). DN 1. is valid whereas
DN 2. is invalid. The DN is given exactly like stored in X.509
As one can see, DN 2. has a different sequence of attributes and
the serialNumber is
given in the country attribute.