Register an error with a cause if a crl cannot be parsed but do not throw an exception.
Do not leak exceptions when getting  the cms signer info.
Move X509 certificate utility methods to the already existing utility class.
Generate a standard java.security.cert.Certificate as a placeholder for the keystore.

There is no need for this certificate to have the RFC3779 resource extension and use the X509 Resource Certificate Parser which brings in unnecessary restrictions.
Validate CRL distribution points when parsing resource certificates.