When I build a self-signed certificate for an internal CA, should I make the issuer DN match the DN in the request, should they be different, or is there no convention for one or the other?
Here are the definitions from RFC 5280 (Setion 3.2):
Self-issued certificates are CA certificates in which the issuer and subject are the same entity. Self-issued certificates are generated to support changes in policy or operations. Self- signed certificates are self-issued certificates where the digital signature may be verified by the public key bound into the certificate. Self-signed certificates are used to convey a public key for use to begin certification paths.
So yes, by definition, since a self-signed certificate is a specific self-issued certificate, its Issuer DN must match its Subject DN.
(Whether this Subject DN needs to be in the CSR is a different matter since (a) CAs don't have any obligation to keep the exact Subject DN when turning a CSR into a cert (in fact they ought to check everything they put into a cert by another means) and (b) the steps that turn a CSR into a self-signed cert have more to do with how
openssl is used for this and how it is configured. That's really just a detail.)
Whether you want your own CA to be self-signed or self-issued is for you to choose. It generally makes sense to do so (at least for clarity). In principle, CA certificates used as trust anchors by your remote parties don't have to be self-signed (see section 6):
The selection of a trust anchor is a matter of policy: it could be the top CA in a hierarchical PKI, the CA that issued the verifier's own certificate(s), or any other CA in a network PKI. The path validation procedure is the same regardless of the choice of trust anchor.