Certificates make use of the interface CertAttrSet. This has a couple methods that assume Hashtable type behavior:

void set(String name, Object obj)
    throws CertificateException, IOException;

Object get(String name)
throws CertificateException, IOException;

One class that implements this interface is netscape.security.x509.Extensions which also extends Hashtable.
At some place, code pulls objects out of the Hashtables and assumes that they can be case to netscape.security.x509.Extension but other places stoer primiteive wrappers in the Hashtable and so forth.

This interface needs to be split into more appropriate pieces. THere should be one interface for managing collections of Extension, and a different one for handling getting/seeting the primitives and other attribute of certificates.