diff --git a/src/main/java/org/jruby/ext/openssl/OCSPBasicResponse.java b/src/main/java/org/jruby/ext/openssl/OCSPBasicResponse.java
index c2b64105..b6912b1e 100644
--- a/src/main/java/org/jruby/ext/openssl/OCSPBasicResponse.java
+++ b/src/main/java/org/jruby/ext/openssl/OCSPBasicResponse.java
@@ -350,8 +350,12 @@ public IRubyObject sign(final ThreadContext context, IRubyObject[] args) {
         }
         
         try {
-            Extension[] respExtAry = new Extension[extensions.size()];
-            Extensions respExtensions = new Extensions(extensions.toArray(respExtAry));
+            final Extensions respExtensions;
+            if (extensions != null && extensions.size() > 0) {
+                respExtensions = new Extensions(extensions.toArray(new Extension[extensions.size()]));
+            } else {
+                respExtensions = null;
+            }
             BasicOCSPResp bcBasicOCSPResp = respBuilder.setResponseExtensions(respExtensions).build(contentSigner, chain, producedAt);
             asn1BCBasicOCSPResp = BasicOCSPResponse.getInstance(bcBasicOCSPResp.getEncoded());
         }
@@ -586,22 +590,21 @@ else if (intOrTime instanceof RubyTime) {
         return new ASN1GeneralizedTime(retTime);
     }
     
-    private Extensions convertRubyExtensions(IRubyObject extensions) {
-        if (extensions.isNil()) return null;
-        List<Extension> retExtensions = new ArrayList<Extension>();
-        Iterator<IRubyObject> rubyExtensions = ((RubyArray)extensions).iterator();
-        while (rubyExtensions.hasNext()) {
-            X509Extension rubyExt = (X509Extension)rubyExtensions.next();
-            Extension ext = Extension.getInstance(((RubyString)rubyExt.to_der()).getBytes());
-            retExtensions.add(ext);
-        }
-        Extension[] exts = new Extension[retExtensions.size()];
-        retExtensions.toArray(exts);
-        return new Extensions(exts);
+    private Extensions convertRubyExtensions(final IRubyObject arg) {
+        if (arg.isNil()) return null;
+        final RubyArray rubyExts = arg.convertToArray(); // Array<X509Extension>
+        if (rubyExts.isEmpty()) return null;
+
+        final Extension[] extensions = new Extension[rubyExts.size()];
+        for (int i = 0; i<extensions.length; i++) {
+            X509Extension rubyExt = (X509Extension) rubyExts.eltInternal(i);
+            extensions[i] = Extension.getInstance((rubyExt.to_der()).getBytes());
+        }
+        return new Extensions(extensions);
     }
     
     private List<java.security.cert.Certificate> convertRubyCerts(IRubyObject certificates) {
-        Iterator<java.security.cert.Certificate> it = ((RubyArray)certificates).iterator();
+        Iterator<java.security.cert.Certificate> it = certificates.convertToArray().iterator();
         List<java.security.cert.Certificate> ret = new ArrayList<java.security.cert.Certificate>();
         while (it.hasNext()) {
             ret.add(it.next());
diff --git a/src/main/java/org/jruby/ext/openssl/X509Extension.java b/src/main/java/org/jruby/ext/openssl/X509Extension.java
index b50f0ca5..129e5c6a 100644
--- a/src/main/java/org/jruby/ext/openssl/X509Extension.java
+++ b/src/main/java/org/jruby/ext/openssl/X509Extension.java
@@ -799,7 +799,7 @@ public IRubyObject set_critical(final ThreadContext context, IRubyObject arg) {
     }
 
     @JRubyMethod
-    public IRubyObject to_der() {
+    public RubyString to_der() {
         try {
             return StringHelper.newString(getRuntime(), toDER());
         }