請求/X509 替代名稱/擴展資訊的完整性

假設請求或 X509 證書中的主題和擴展資訊都受到保護，我是否正確？

這個簽名只是嵌入在 ASN.1 編碼中的另一個元素？

你是對的。這兩個項目的完整性可以通過請求上的數字簽名（使用請求者的私鑰簽名）或證書（由 CA 的私鑰簽名）來驗證。

編輯：

RFC 2986，第 3 節描述 PKCS #10 證書請求：

3. Overview

   A certification request consists of three parts: "certification
   request information," a signature algorithm identifier, and a digital
   signature on the certification request information.

…

        1. A CertificationRequestInfo value containing a subject
           distinguished name, a subject public key, and optionally a
           set of attributes is constructed by an entity requesting
           certification.

        2. The CertificationRequestInfo value is signed with the subject
           entity's private key.  (See Section 4.2.)

第 5 頁：

The components of type CertificationRequestInfo have the following
   meanings:

…

 attributes is a collection of attributes providing additional
          information about the subject of the certificate.  Some
          attribute types that might be useful here are defined in PKCS
          ...
          certificate revocation.  Another example is information to
          appear in X.509 certificate extensions (e.g. the
          extensionRequest attribute from PKCS #9).  The values of type

RFC 5280 re：x.509 證書：

4.1.1.3.  signatureValue

   The signatureValue field contains a digital signature computed upon
   the ASN.1 DER encoded tbsCertificate.  The ASN.1 DER encoded
   tbsCertificate is used as the input to the signature function.
   ...


4.1.2.  TBSCertificate

   The sequence TBSCertificate contains information associated with the
   subject of the certificate and the CA that issued it.  Every
   TBSCertificate contains the names of the subject and issuer, a public
   key associated with the subject, a validity period, a version number,
   and a serial number; some MAY contain optional unique identifier
   fields.  The remainder of this section describes the syntax and
   semantics of these fields.  A TBSCertificate usually includes
   extensions.

引用自：https://serverfault.com/questions/588108