diff --git a/core/java/src/net/i2p/data/Certificate.java b/core/java/src/net/i2p/data/Certificate.java
index 522200098..c6d7c61b2 100644
--- a/core/java/src/net/i2p/data/Certificate.java
+++ b/core/java/src/net/i2p/data/Certificate.java
@@ -44,7 +44,7 @@ public class Certificate extends DataStructureImpl {
     public final static int CERTIFICATE_TYPE_MULTIPLE = 4;
 
     /**
-     * Pull from cache or return new
+     * If null cert, return immutable static instance, else create new
      * @throws AIOOBE if not enough bytes
      * @since 0.8.3
      */
@@ -57,7 +57,7 @@ public class Certificate extends DataStructureImpl {
         if (length == 0)
             return new Certificate(type, null);
         byte[] payload = new byte[length];
-        System.arraycopy(data, off = 3, payload, 0, length);
+        System.arraycopy(data, off + 3, payload, 0, length);
         return new Certificate(type, payload);
     }
 
diff --git a/router/java/src/net/i2p/router/Router.java b/router/java/src/net/i2p/router/Router.java
index 79f05bbd4..eee3ac866 100644
--- a/router/java/src/net/i2p/router/Router.java
+++ b/router/java/src/net/i2p/router/Router.java
@@ -539,16 +539,14 @@ public class Router {
             return true;
         return Boolean.valueOf(_context.getProperty(PROP_HIDDEN_HIDDEN)).booleanValue();
     }
+
+    /**
+     *  @return the certificate for a new RouterInfo - probably a null cert.
+     */
     public Certificate createCertificate() {
-        Certificate cert = new Certificate();
-        if (isHidden()) {
-            cert.setCertificateType(Certificate.CERTIFICATE_TYPE_HIDDEN);
-            cert.setPayload(null);
-        } else {
-            cert.setCertificateType(Certificate.CERTIFICATE_TYPE_NULL);
-            cert.setPayload(null);
-        }
-        return cert;
+        if (isHidden())
+            return new Certificate(Certificate.CERTIFICATE_TYPE_HIDDEN, null);
+        return Certificate.NULL_CERT;
     }
     
     /**