When an signed JCE provider is configured with the highest preference, the JDK
cannot verify the signatures on that provider JAR file. So the provider is
loaded as an unsigned JAR. Later, class.getProtectionDomain().getCodeSource().getCertificates() returns null
since that JAR file was loaded as an unsigned JAR.

So JCE should avoid using the above method to get signer's certificate.