com.sun.corba.se.internal.io.ObjectStreamClass only looks for directly declared writeReplace/readResolve methods; it does not look for inherited ones. In contrast, java.io.ObjectStreamClass does look for inherited ones. As a result, instances of some classes can be serialized through normal serialization but cannot be serialized through IIOP. A particular example is java.security.cert.Certificate, which has a protected writeReplace that is intended to cover all subclasses; certificate instances cannot be serialized through IIOP.