In Ruby (OpenSSL, really), the "keyid" of "authorityKeyIdentifier" has an optional ":always" value. However in JRuby openssl, it looks for "keyid:" and therefore fails when the optional value is left off. The documentation is here: https://www.openssl.org/docs/man1.0.2/apps/x509v3_config.html Note the example is just `keyid,issuer`.