diff --git a/rust/src/x509/mod.rs b/rust/src/x509/mod.rs
index d15f61d0d8..6ee7c8a7ff 100644
--- a/rust/src/x509/mod.rs
+++ b/rust/src/x509/mod.rs
@@ -130,13 +130,17 @@ pub unsafe extern "C" fn SCX509GetSubjectAltNameAt(ptr: *const X509, idx: u16) -
 }
 
 #[no_mangle]
-pub unsafe extern "C" fn SCX509GetIssuer(ptr: *const X509) -> *mut c_char {
+pub unsafe extern "C" fn SCX509GetIssuer(ptr: *const X509, issuer_name: *mut *mut u8, issuer_len: *mut u32) {
     if ptr.is_null() {
-        return std::ptr::null_mut();
+        *issuer_len = 0;
+        *issuer_name = std::ptr::null_mut();
+        return;
     }
     let x509 = cast_pointer! {ptr, X509};
-    let issuer = x509.0.tbs_certificate.issuer.to_string();
-    rust_string_to_c(issuer)
+    let issuer = x509.0.tbs_certificate.issuer.to_string().into_bytes();
+
+    *issuer_len = issuer.len() as u32;
+    *issuer_name = Box::into_raw(issuer.into_boxed_slice()) as *mut u8;
 }
 
 #[no_mangle]
diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c
index f79e58bb65..607c857f77 100644
--- a/src/app-layer-ssl.c
+++ b/src/app-layer-ssl.c
@@ -496,12 +496,11 @@ static int TlsDecodeHSCertificate(SSLState *ssl_state, SSLStateConnp *connp,
             goto error;
         }
 
-        char *str = SCX509GetIssuer(x509);
-        if (str == NULL) {
+        SCX509GetIssuer(x509, &connp->cert0_issuerdn, &connp->cert0_issuerdn_len);
+        if (connp->cert0_issuerdn == NULL) {
             err_code = ERR_EXTRACT_ISSUER;
             goto error;
         }
-        connp->cert0_issuerdn = str;
 
         connp->cert0_sans_len = SCX509GetSubjectAltNameLen(x509);
         char **sans = SCCalloc(connp->cert0_sans_len, sizeof(char *));
@@ -512,7 +511,7 @@ static int TlsDecodeHSCertificate(SSLState *ssl_state, SSLStateConnp *connp,
             sans[i] = SCX509GetSubjectAltNameAt(x509, i);
         }
         connp->cert0_sans = sans;
-        str = SCX509GetSerial(x509);
+        char *str = SCX509GetSerial(x509);
         if (str == NULL) {
             err_code = ERR_INVALID_SERIAL;
             goto error;
@@ -2857,7 +2856,8 @@ static void SSLStateFree(void *p)
         SCX509ArrayFree(
                 ssl_state->client_connp.cert0_subject, ssl_state->client_connp.cert0_subject_len);
     if (ssl_state->client_connp.cert0_issuerdn)
-        SCRustCStringFree(ssl_state->client_connp.cert0_issuerdn);
+        SCX509ArrayFree(
+                ssl_state->client_connp.cert0_issuerdn, ssl_state->client_connp.cert0_issuerdn_len);
     if (ssl_state->client_connp.cert0_serial)
         SCRustCStringFree(ssl_state->client_connp.cert0_serial);
     if (ssl_state->client_connp.cert0_fingerprint)
@@ -2873,7 +2873,8 @@ static void SSLStateFree(void *p)
         SCX509ArrayFree(
                 ssl_state->server_connp.cert0_subject, ssl_state->server_connp.cert0_subject_len);
     if (ssl_state->server_connp.cert0_issuerdn)
-        SCRustCStringFree(ssl_state->server_connp.cert0_issuerdn);
+        SCX509ArrayFree(
+                ssl_state->server_connp.cert0_issuerdn, ssl_state->server_connp.cert0_issuerdn_len);
     if (ssl_state->server_connp.cert0_serial)
         SCRustCStringFree(ssl_state->server_connp.cert0_serial);
     if (ssl_state->server_connp.cert0_fingerprint)
diff --git a/src/app-layer-ssl.h b/src/app-layer-ssl.h
index 0c200d90fe..5c0500e3bc 100644
--- a/src/app-layer-ssl.h
+++ b/src/app-layer-ssl.h
@@ -184,10 +184,11 @@ typedef struct SSLStateConnp_ {
     uint16_t session_id_length;
 
     uint8_t random[TLS_RANDOM_LEN];
-    char *cert0_issuerdn;
     char *cert0_serial;
     uint8_t *cert0_subject;
     uint32_t cert0_subject_len;
+    uint8_t *cert0_issuerdn;
+    uint32_t cert0_issuerdn_len;
     int64_t cert0_not_before;
     int64_t cert0_not_after;
     char *cert0_fingerprint;
diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c
index a270ed51fc..894d7060e7 100644
--- a/src/detect-tls-cert-issuer.c
+++ b/src/detect-tls-cert-issuer.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2022 Open Information Security Foundation
+/* Copyright (C) 2007-2025 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -138,8 +138,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        const uint32_t data_len = (uint32_t)strlen(connp->cert0_issuerdn);
-        const uint8_t *data = (uint8_t *)connp->cert0_issuerdn;
+        const uint32_t data_len = connp->cert0_issuerdn_len;
+        const uint8_t *data = connp->cert0_issuerdn;
 
         InspectionBufferSetupAndApplyTransforms(
                 det_ctx, list_id, buffer, data, data_len, transforms);
diff --git a/src/detect-tls.c b/src/detect-tls.c
index fe8212f958..c637bb74c3 100644
--- a/src/detect-tls.c
+++ b/src/detect-tls.c
@@ -378,7 +378,9 @@ static int DetectTlsIssuerDNMatch (DetectEngineThreadCtx *det_ctx,
         SCLogDebug("TLS: IssuerDN is [%s], looking for [%s]\n",
                    connp->cert0_issuerdn, tls_data->issuerdn);
 
-        if (strstr(connp->cert0_issuerdn, tls_data->issuerdn) != NULL) {
+        if (SpmSearch(connp->cert0_issuerdn, connp->cert0_issuerdn_len,
+                    (const uint8_t *)tls_data->issuerdn,
+                    (uint16_t)strlen(tls_data->issuerdn)) != NULL) {
             if (tls_data->flags & DETECT_CONTENT_NEGATED) {
                 ret = 0;
             } else {
diff --git a/src/log-tlsstore.c b/src/log-tlsstore.c
index 3467399bb6..1724975f16 100644
--- a/src/log-tlsstore.c
+++ b/src/log-tlsstore.c
@@ -235,12 +235,16 @@ static void LogTlsLogPem(LogTlsStoreLogThread *aft, const Packet *p, SSLState *s
         }
 
         char *subject = CreateStringFromByteArray(connp->cert0_subject, connp->cert0_subject_len);
+        char *issuerdn =
+                CreateStringFromByteArray(connp->cert0_issuerdn, connp->cert0_issuerdn_len);
         int r = fprintf(fpmeta,
                 "TLS SUBJECT:       %s\n"
                 "TLS ISSUERDN:      %s\n"
                 "TLS FINGERPRINT:   %s\n",
-                subject ? subject : "<ERROR>", connp->cert0_issuerdn, connp->cert0_fingerprint);
+                subject ? subject : "<ERROR>", issuerdn ? issuerdn : "<ERROR>",
+                connp->cert0_fingerprint);
         SCFree(subject);
+        SCFree(issuerdn);
         if (r < 0)
             goto end_fwrite_fpmeta;
 
diff --git a/src/output-json-tls.c b/src/output-json-tls.c
index cfd6c84245..1b53782af8 100644
--- a/src/output-json-tls.c
+++ b/src/output-json-tls.c
@@ -144,7 +144,12 @@ static void JsonTlsLogSubject(SCJsonBuilder *js, SSLState *ssl_state)
 static void JsonTlsLogIssuer(SCJsonBuilder *js, SSLState *ssl_state)
 {
     if (ssl_state->server_connp.cert0_issuerdn) {
-        SCJbSetString(js, "issuerdn", ssl_state->server_connp.cert0_issuerdn);
+        if (ssl_state->server_connp.cert0_issuerdn_len == 0) {
+            SCJbSetString(js, "issuerdn", "");
+        } else {
+            SCJbSetStringFromBytes(js, "issuerdn", ssl_state->server_connp.cert0_issuerdn,
+                    ssl_state->server_connp.cert0_issuerdn_len);
+        }
     }
 }
 
@@ -350,7 +355,12 @@ static void JsonTlsLogClientCert(
         }
     }
     if (connp->cert0_issuerdn != NULL) {
-        SCJbSetString(js, "issuerdn", connp->cert0_issuerdn);
+        if (connp->cert0_issuerdn_len == 0) {
+            SCJbSetString(js, "issuerdn", "");
+        } else {
+            SCJbSetStringFromBytes(
+                    js, "issuerdn", connp->cert0_issuerdn, connp->cert0_issuerdn_len);
+        }
     }
     if (connp->cert0_fingerprint) {
         SCJbSetString(js, "fingerprint", connp->cert0_fingerprint);
diff --git a/src/util-lua-tls.c b/src/util-lua-tls.c
index 6805019832..12becb7940 100644
--- a/src/util-lua-tls.c
+++ b/src/util-lua-tls.c
@@ -175,7 +175,7 @@ static int GetCertInfo(lua_State *luastate, bool client, const SSLState *ssl_sta
 
     int r = LuaPushStringBuffer(luastate, (uint8_t *)ssl_version, strlen(ssl_version));
     r += LuaPushStringBuffer(luastate, connp->cert0_subject, connp->cert0_subject_len);
-    r += LuaPushStringBuffer(luastate, (uint8_t *)connp->cert0_issuerdn, strlen(connp->cert0_issuerdn));
+    r += LuaPushStringBuffer(luastate, connp->cert0_issuerdn, connp->cert0_issuerdn_len);
     r += LuaPushStringBuffer(luastate, (uint8_t *)connp->cert0_fingerprint, strlen(connp->cert0_fingerprint));
     return r;
 }