diff --git a/Data/Certificate/X509.hs b/Data/Certificate/X509.hs
--- a/Data/Certificate/X509.hs
+++ b/Data/Certificate/X509.hs
@@ -44,14 +44,26 @@
 import Data.Certificate.X509.Cert
 import Data.Certificate.X509.Ext
 
-data X509 = X509 Certificate (Maybe L.ByteString) (Maybe L.ByteString) SignatureALG [Word8]
-	deriving (Show,Eq)
+data X509 = X509
+	{ x509Cert              :: Certificate          -- ^ the certificate part of a X509 structure
+	, x509CachedSigningData :: (Maybe L.ByteString) -- ^ a cache of the raw representation of the x509 part for signing
+                                                        -- since encoding+decoding might not result in the same data being signed.
+	, x509CachedData        :: (Maybe L.ByteString) -- ^ a cache of the raw representation of the whole x509.
+	, x509SignatureALG      :: SignatureALG         -- ^ the signature algorithm used.
+	, x509Signature         :: [Word8]              -- ^ the signature.
+	} deriving (Show)
 
+instance Eq X509 where
+	x1 == x2 =
+		(x509Cert x1         == x509Cert x2)         &&
+		(x509SignatureALG x1 == x509SignatureALG x2) &&
+		(x509Signature x1    == x509Signature x2)
+
 {- | get signing data related to a X509 message,
  - which is either the cached data or the encoded certificate -}
 getSigningData :: X509 -> L.ByteString
-getSigningData (X509 _    (Just e) _ _ _)   = e
-getSigningData (X509 cert Nothing _ _ _) = e
+getSigningData (X509 _    (Just e) _ _ _) = e
+getSigningData (X509 cert Nothing _ _ _)  = e
 	where
 		(Right e) = encodeASN1Stream header
 		header    = asn1Container Sequence $ encodeCertificateHeader cert
diff --git a/Data/Certificate/X509/Cert.hs b/Data/Certificate/X509/Cert.hs
--- a/Data/Certificate/X509/Cert.hs
+++ b/Data/Certificate/X509/Cert.hs
@@ -26,7 +26,7 @@
 	) where
 
 import Data.Word
-import Data.List (find)
+import Data.List (find, sortBy)
 import Data.ASN1.DER
 import Data.ASN1.BitArray
 import Data.Maybe
@@ -69,9 +69,9 @@
 	  PubKeyRSA RSA.PublicKey -- ^ RSA public key
 	| PubKeyDSA DSA.PublicKey -- ^ DSA public key
 	| PubKeyDH (Integer,Integer,Integer,Maybe Integer,([Word8], Integer))
-	                                                 -- ^ DH format with (p,g,q,j,(seed,pgenCounter))
-	| PubKeyECDSA [ASN1]                             -- ^ ECDSA format not done yet FIXME
-	| PubKeyUnknown OID [Word8]                      -- ^ unrecognized format
+	                            -- ^ DH format with (p,g,q,j,(seed,pgenCounter))
+	| PubKeyECDSA [ASN1]        -- ^ ECDSA format not done yet FIXME
+	| PubKeyUnknown OID [Word8] -- ^ unrecognized format
 	deriving (Show,Eq)
 
 type Time = (Day, DiffTime, Bool)
@@ -152,6 +152,7 @@
 	, ([1,2,840,113549,1,1,4], SignatureALG HashMD5 PubKeyALG_RSA)
 	, ([1,2,840,113549,1,1,2], SignatureALG HashMD2 PubKeyALG_RSA)
 	, ([1,2,840,113549,1,1,11], SignatureALG HashSHA256 PubKeyALG_RSA)
+	, ([1,2,840,113549,1,1,12], SignatureALG HashSHA384 PubKeyALG_RSA)
 	, ([1,2,840,10040,4,3],    SignatureALG HashSHA1 PubKeyALG_DSA)
 	, ([1,2,840,10045,4,3,1],  SignatureALG HashSHA224 PubKeyALG_ECDSA)
 	, ([1,2,840,10045,4,3,2],  SignatureALG HashSHA256 PubKeyALG_ECDSA)
@@ -213,20 +214,19 @@
 encodeAsn1String (IA5, x)       = IA5String x
 encodeAsn1String (T61, x)       = T61String x
 
-parseCertHeaderDN :: ParseASN1 [ (OID, ASN1String) ]
-parseCertHeaderDN = do
-	onNextContainer Sequence getDNs
-	where
-		getDNs = do
-			n <- hasNext
-			if n
-				then liftM2 (:) parseDNOne getDNs
-				else return []
-		parseDNOne = onNextContainer Set $ do
-			s <- getNextContainer Sequence
-			case s of
-				[OID oid, val] -> return (oid, asn1String val)
-				_              -> throwError "expecting sequence"
+parseCertHeaderDN :: ParseASN1 [(OID, ASN1String)]
+parseCertHeaderDN = sortByOID <$> onNextContainer Sequence getDNs where
+	sortByOID = sortBy (\a b -> fst a `compare` fst b)
+	getDNs = do
+		n <- hasNext
+		if n
+			then liftM2 (:) parseDNOne getDNs
+			else return []
+	parseDNOne = onNextContainer Set $ do
+		s <- getNextContainer Sequence
+		case s of
+			[OID oid, val] -> return (oid, asn1String val)
+			_              -> throwError "expecting sequence"
 
 parseCertHeaderValidity :: ParseASN1 (Time, Time)
 parseCertHeaderValidity = do
@@ -268,9 +268,9 @@
 		_              -> throwError "expecting bitstring"
 
 parseCertExtensions :: ParseASN1 (Maybe [CertificateExt])
-parseCertExtensions = do
-	onNextContainerMaybe (Container Context 3) (mapMaybe extractExtension <$> onNextContainer Sequence getSequences)
+parseCertExtensions = onNextContainerMaybe (Container Context 3) (sortByOID . mapMaybe extractExtension <$> onNextContainer Sequence getSequences)
 	where
+		sortByOID = sortBy (\(a,_,_) (b,_,_) -> a `compare` b)
 		getSequences = do
 			n <- hasNext
 			if n
diff --git a/certificate.cabal b/certificate.cabal
--- a/certificate.cabal
+++ b/certificate.cabal
@@ -1,5 +1,5 @@
 Name:                certificate
-Version:             1.0.0
+Version:             1.0.1
 Description:
     Certificates and Key reader/writer
     .