You can make an asn1 dump of a certificate in order to study the asn1 produced:

$ bin/ejbca.sh asn1dump <filename-of-pem-encoded-certs or filename-of-der-encoded-asn1>

Example:

$ bin/ejbca.sh asn1dump managementca.pem