diff --git a/openid-connect-common/src/main/java/org/mitre/jwt/signer/service/impl/DefaultJwtSigningAndValidationService.java b/openid-connect-common/src/main/java/org/mitre/jwt/signer/service/impl/DefaultJwtSigningAndValidationService.java
index 94b31e9d8..0e310d9b6 100644
--- a/openid-connect-common/src/main/java/org/mitre/jwt/signer/service/impl/DefaultJwtSigningAndValidationService.java
+++ b/openid-connect-common/src/main/java/org/mitre/jwt/signer/service/impl/DefaultJwtSigningAndValidationService.java
@@ -94,6 +94,7 @@ public class DefaultJwtSigningAndValidationService implements JwtSigningAndValid
 	 */
 	public DefaultJwtSigningAndValidationService(JWKSetKeyStore keyStore) throws NoSuchAlgorithmException, InvalidKeySpecException {
 		// convert all keys in the keystore to a map based on key id
+		if (keyStore!= null && keyStore.getJwkSet() != null) {
 		for (JWK key : keyStore.getKeys()) {
 			if (!Strings.isNullOrEmpty(key.getKeyID())) {
 				this.keys.put(key.getKeyID(), key);
@@ -101,6 +102,7 @@ public class DefaultJwtSigningAndValidationService implements JwtSigningAndValid
 				throw new IllegalArgumentException("Tried to load a key from a keystore without a 'kid' field: " + key);
 			}
 		}
+		}
 		//buildSignersAndVerifiers();
 	}