#vulnerable code 
                                public static PublicKey fetchServerPublicKey(TlsConfig config) {
        X509CertificateObject cert = fetchServerCertificate(config);
        return cert.getPublicKey();
    } 
                            #location 3 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public static PublicKey fetchServerPublicKey(TlsConfig config) {
        X509CertificateObject cert;
        try {
            cert = new X509CertificateObject(fetchServerCertificate(config).getCertificateAt(0));
        } catch (CertificateParsingException ex) {
            throw new WorkflowExecutionException("Could not get public key from server certificate", ex);
        }
        return cert.getPublicKey();
    }