In DER a DN is a SEQUENCE of relative distinguished names, each a SET of attribute type (an OID such as 2.5.4.3 for commonName) and value. Its string form follows RFC 4514 and is written most-specific first (CN=example.com,O=Example Inc,C=US), while OpenSSL prints it in encoding order (C = US, O = Example Inc, CN = example.com). Comparisons in path validation use the encoded form with case-insensitive matching rules (RFC 5280 §7.1), so re-encoding a name from a string can break chains.
For TLS, the subject DN no longer identifies the server: browsers match only subjectAltName, and the Baseline Requirements mark the subject commonName as not recommended, allowing it only as a copy of a SAN value. DNs still matter for issuer–subject chaining, for OV and EV organization details, and for client certificates mapped to user accounts.