Only add extensions if non-empty

1 files changed, 2 insertions, 1 deletions

diff --git a/security-utils/src/main/java/com/yahoo/security/Pkcs10CsrBuilder.java b/security-utils/src/main/java/com/yahoo/security/Pkcs10CsrBuilder.java
index c34e3acb09f..629b610564a 100644
--- a/security-utils/src/main/java/com/yahoo/security/Pkcs10CsrBuilder.java
+++ b/security-utils/src/main/java/com/yahoo/security/Pkcs10CsrBuilder.java
@@ -90,7 +90,8 @@ public class Pkcs10CsrBuilder {
                                 .toArray(GeneralName[]::new));
                 extGen.addExtension(Extension.subjectAlternativeName, false, generalNames);
             }
-            requestBuilder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate());
+            if (!extGen.isEmpty())
+                requestBuilder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest, extGen.generate());
             ContentSigner contentSigner = new JcaContentSignerBuilder(signatureAlgorithm.getAlgorithmName())
                     .setProvider(BouncyCastleProviderHolder.getInstance())
                     .build(keyPair.getPrivate());