The authorityKeyIdentifier extension validation is not aligned with VOMS native APIs behavior. Currently, the Java APIs only validates the extension criticality.

The API should instead check that the AuthorityKeyIdentifier extension is consistent with the VOMS attribute authority certificate that is used to sign the AC.

The API also provides a buggy encoding of the AuthorityKeyIdentifier, since it embeds the extension extracted from the VOMS AA certificate in the AC.