The HTTPS host verifier detection is causing NPEs when JSSE is missing.
Even if the user is not using HTTPS.

This will log a warning and leave the class as null

// Determine the type of the HttpsURLConnection in this runtime
ClassLoader loader = Thread.currentThread().getContextClassLoader();
try

{ // First look for the JDK 1.4 JSSE Https connection httpsConnClass = loader.loadClass("javax.net.ssl.HttpsURLConnection"); log.debug("httpsConnClass: " + httpsConnClass); }

catch (Exception e)
{
// Next try the JSSE external dist Https connection
try

{ httpsConnClass = loader.loadClass("com.sun.net.ssl.HttpsURLConnection"); log.debug("httpsConnClass: " + httpsConnClass); }

catch (Exception e2)

{ log.warn("No HttpsURLConnection seen"); }

}

This will throw an NPE

boolean isHttpsConn = httpsConnClass.isAssignableFrom(conn.getClass());
if (isHttpsConn)
{
// See if the org.jboss.security.ignoreHttpsHost property is set
if (Boolean.getBoolean(IGNORE_HTTPS_HOST) == true)

{ AnyhostVerifier.setHostnameVerifier(conn); }

}