Keep in mind that ASN.1 integers are Signed int, so if any integers you want to encode have the high bit set you need to add a single zero octet to the start of the encoded value to ensure that the high bit isn't mistaken for a sign bit.
In addition you are allowed at most a single 0 byte at the start of an encoded value (and that only when the high bit is set), if the internal representation you use contains zero bytes at the start you have to remove them on encoding. This is a bit of a nuisance when encoding signatures which have INTEGER values, since you can't tell how big the encoded signature will be without actually generating it.!! More Information There might be more information for this subject on one of the following: