Why does Nginx Provide the Client SSL DN in reverse order?

Why is this?

It's because that's what's returned by OpenSSL. Apache HTTPD does the same thing, because it also uses OpenSSL.

Which one matches the LDAP RFC?

The one you describe as 'standard order'. However this is an SSL certificate and an SSL API. It doesn't have anything to do with LDAP and there is no reason why it should conform to any LDAP RFC. It's just another way of providing the DN of the certificate subject. This is defined by X.509, not by LDAP (although ultimately they are all defined by X.500, at least originally).

Is there a Java library to convert back and forth (from reverse to not reverse)

Off topic, and not that I'm aware of, but it's easy enough to write:

public class OpenSSLSubjectName{    private String  name;    public OpenSSLSubjectName(String name)    {        this.name = name;    }    public String   getX500Name() throws NamingException    {        return getLdapName().toString();    }    public LdapName getLdapName() throws NamingException    {        List<Rdn>   rdns = new LinkedList<>();        String[]    parts = name.split("/");        for (int i = 1; i < parts.length; i++)        {            rdns.add(new Rdn(parts[i]));        }        return new LdapName(rdns);    }}

E&OE