Getting CRL list for certification path fails when there is more than one CRL for the same issuer DN

[rgala]

I'm trying to validate a signature with CRL checking, but if fails with

java.security.SignatureException: Signature does not match.

I have two files containing CRL for two diferent CAs, but both have the same issuer DN which, I
believe, is causing the problem, because getCRLsForCertPath in class PKIXCertificateValidationProvider is choosing wrong CRL by matching only issuer DN of a CRL (I think it should check key identifier too).

I have attached a sample Maven project to reproduce the issue. It will download current CRL from selected CAs so you will need internet connection.

project.zip