There is an encoding bug related to the DistributionPointName object in sun/security/x509/IssuingDistributionPointExtension.java:
*
* The fix would be:
*
* ***************
* *** 395,397 ****
* distributionPoint.encode(tmp);
* ! tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, true,
* TAG_DISTRIBUTION_POINT), tmp);
* --- 395,397 ----
* distributionPoint.encode(tmp);
* ! tagged.write(DerValue.createTag(DerValue.TAG_CONTEXT, true,
* TAG_DISTRIBUTION_POINT), tmp);
*

The reason is that a CHOICE field should not be encode as IMPLICIT, otherwise, the choice number is lost.