A coding error was introduced into keytool in the recent code changes on -ext support (6780416), Now keytool assumes a certificate always have extensions. Although this is true for certificates created by keytool from now on, it's not true for others, where an NPE is thrown.