Currently the X509CertImpl constructor takes a byte array of certificate data, so in many cases the certificate objects obtained from JSS have to be explicitly encoded first:

X509Certificate jssCert = cryptoManager.findCertByNickname(nickname);
byte[] certData = jssCert .getEncoded();
X509CertImpl cert = new X509CertImpl(certData);

It would be nice to add another constructor that can take the JSS certificate directly:

X509Certificate jssCert = cryptoManager.findCertByNickname(nickname);
X509CertImpl cert = new X509CertImpl(jssCert);

Internally the constructor will simply get the encoded certificate data from the parameter, then pass it to the existing X509CertImpl constructor that takes the encoded certificate data.

The constructor could also check if the parameter is already an instance of X509CertImpl. In that case it can do a normal Java copy constructor operation, but we should consider if it's much more efficient than encoding and decoding the certificate data.