Hashtable.containsKey call is unnecessary before following Hashtable.get call. Hashtable allows only null values. It means we can replace containsKey+get with get+null check.

            if (cfs.containsKey(certType)) {
                cf = cfs.get(certType);
            } else {
                // create new certificate factory
                ...
                cfs.put(certType, cf);
            }

We can update to:

            CertificateFactory cf = cfs.get(certType);
            if (cf == null) {
                // create new certificate factory
                ...
                cfs.put(certType, cf);
            }

It's clearer and a bit faster.