src/share/classes/sun/security/x509/X509CertImpl.java

@@ -1072,13 +1072,18 @@
             AuthorityKeyIdentifierExtension aki =
                 getAuthorityKeyIdentifierExtension();
             if (aki != null) {
 
                 try {
-                    issuerKeyId = ((KeyIdentifier)
-                        aki.get(AuthorityKeyIdentifierExtension.KEY_ID))
-                            .getIdentifier();
+                    KeyIdentifier ki =
+                        ((KeyIdentifier) aki.get(
+                            AuthorityKeyIdentifierExtension.KEY_ID));
+                    if (ki != null) {
+                        issuerKeyId = ki.getIdentifier();
+                    } else {
+                        issuerKeyId = new byte[0]; // no hash-based AKID present
+                    }
                 } catch (IOException e) {
                     // should never happen (because KEY_ID attr is supported)
                 }
 
             } else {