Coverity static-analysis scan found possible call on null object in EntityUtil.encodeAlgorithmIdentifier method:
https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=5760335&defectInstanceId=1541381&mergedDefectId=1369303

In the call
encodeAlgorithmIdentifier(encoder, algorithmOid(algorithm), omitParametersField);
the algorithmOid() may return null (look at Entity class).
Then the encodeAlgorithmIdentifier calls DerEncoder.encodeObjectIdentifier where on the given String is called length() method without a null check.