ADDITIONAL SYSTEM INFORMATION :
java version "11-ea" 2018-09-25
Java(TM) SE Runtime Environment 18.9 (build 11-ea+20)
Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11-ea+20, mixed mode)

A DESCRIPTION OF THE PROBLEM :
Starting with 11-ea+20, SSLSessionImpl.getLocalPrincipal() throws a NullPointerException when localCerts is null. This breaks widely used HTTP clients such as Apache HttpComponents.

REGRESSION : Last worked in version 11

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Execute any code that uses sun.security.ssl.SSLSessionImpl but does not use any local certs and call getLocalPrincipal().


EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The method returns null.
ACTUAL -
The method throws a NullPointerException.

---------- BEGIN SOURCE ----------
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;

public class Main {
    public static void main(String[] args) throws Exception {
        SSLSocket socket = (SSLSocket) SSLSocketFactory.getDefault().createSocket("docs.oracle.com", 443);
        System.out.println(socket.getSession().getLocalPrincipal());
    }
}
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Users could catch NullPointerException, but it clearly contradicts the Javadoc and used to work up to 11-ea+19.

FREQUENCY : always