假设在请求或X509证书中修改主题和扩展信息的保护是否正确？
这个签名只是embedded在ASN.1编码中的另一个元素？
你是对的。 这两个项目的完整性可以通过请求（用请求者的私钥签名）或证书（由CA私钥签名）上的数字签名来validation。
编辑：
RFC 2986第3节描述了PKCS＃10证书请求：
3. Overview A certification request consists of three parts: "certification request information," a signature algorithm identifier, and a digital signature on the certification request information.…
1. A CertificationRequestInfo value containing a subject distinguished name, a subject public key, and optionally a set of attributes is constructed by an entity requesting certification. 2. The CertificationRequestInfo value is signed with the subject entity's private key. (See Section 4.2.)
和第5页：
The components of type CertificationRequestInfo have the following meanings:…
attributes is a collection of attributes providing additional information about the subject of the certificate. Some attribute types that might be useful here are defined in PKCS ... certificate revocation. Another example is information to appear in X.509 certificate extensions (eg the extensionRequest attribute from PKCS #9). The values of type
RFC 5280 re：x.509证书：
4.1.1.3. signatureValue The signatureValue field contains a digital signature computed upon the ASN.1 DER encoded tbsCertificate. The ASN.1 DER encoded tbsCertificate is used as the input to the signature function. ... 4.1.2. TBSCertificate The sequence TBSCertificate contains information associated with the subject of the certificate and the CA that issued it. Every TBSCertificate contains the names of the subject and issuer, a public key associated with the subject, a validity period, a version number, and a serial number; some MAY contain optional unique identifier fields. The remainder of this section describes the syntax and semantics of these fields. A TBSCertificate usually includes extensions.