The current implementation of X509Certificate::subjectName() doesn't return return non ASCII UTF-8 characters. Instead it returns them in hex escaped form.

If the subject conains Zählerweg as the locality the expected return would be:

/L=Zählerweg

However X509Certificate::subjectName() returns:

/L=Z\xC3\xA4hlerweg

Using subjectName(X509Certificate::NID_LOCALITY_NAME) properly returns Zählerweg

So i think the issue lies in the OpenSSL function X509_NAME_oneline, used here which according to the documentation is "strongly discouraged in new applications".

Test case to reproduce issue:

https://github.com/siemens/poco/commit/eb35254610b4c793a13983c5f8482737414d4591

Poco Version: 1.9.4 and master