After JDK-8297955 a CRL selector whose IssuerNames contains the value "null" (invalid) makes CertStore.getCRLs to throw a NullPointerException. Previous to JDK-8297955, this same selector threw a CertStoreException when passed to CertStore.getCRLs.

A CertStoreException looks more aligned to the CertStore.getCRLs API documentation: "@throws CertStoreException if an exception occurs".

The underlying reason is that after JDK-8297955 the LDAPRequest constructor passes the received "name" to the LdapName constructor. The LdapName constructor expects this value to be non-null. Thus, it does not throw an InvalidNameException —which the LDAPRequest constructor would have turned into a CertStoreException— and tries to get the length of the name, which ends in a NullPointerException. The LDAPRequest constructor does not handle the NullPointerException so it bubbles up to the caller.

Before JDK-8297955, the LDAPRequest constructor called "checkName" which, in the event of a null name, explicitly threw a CertStoreException.