diff --git a/choam/src/main/java/com/salesforce/apollo/choam/support/Bootstrapper.java b/choam/src/main/java/com/salesforce/apollo/choam/support/Bootstrapper.java
index a47e4438d..60ccc78d3 100644
--- a/choam/src/main/java/com/salesforce/apollo/choam/support/Bootstrapper.java
+++ b/choam/src/main/java/com/salesforce/apollo/choam/support/Bootstrapper.java
@@ -118,9 +118,9 @@ private void checkpointCompletion(int threshold, Initial mostRecent) {
         store.put(checkpointView);
         assert !checkpointView.height()
                               .equals(Unsigned.ulong(0)) : "Should not attempt when bootstrapping from genesis";
-        var diadem = HexBloom.from(checkpoint.block.getCheckpoint().getCrown());
+        var crown = HexBloom.from(checkpoint.block.getCheckpoint().getCrown());
         log.info("Assembling from checkpoint: {}:{} crown: {} last cp: {} on: {}", checkpoint.height(), checkpoint.hash,
-                 diadem.compactWrapped(), Digest.from(checkpoint.block.getHeader().getLastCheckpointHash()),
+                 crown.compactWrapped(), Digest.from(checkpoint.block.getHeader().getLastCheckpointHash()),
                  params.member().getId());
 
         CheckpointAssembler assembler = new CheckpointAssembler(params.gossipDuration(), checkpoint.height(),
@@ -130,10 +130,10 @@ private void checkpointCompletion(int threshold, Initial mostRecent) {
 
         // assemble the checkpoint
         checkpointAssembled = assembler.assemble(scheduler, params.gossipDuration()).whenComplete((cps, t) -> {
-            if (!cps.validate(diadem, Digest.from(checkpoint.block.getHeader().getLastCheckpointHash()))) {
+            if (!cps.validate(crown, Digest.from(checkpoint.block.getHeader().getLastCheckpointHash()))) {
                 throw new IllegalStateException("Cannot validate checkpoint: " + checkpoint.height());
             }
-            log.info("Restored checkpoint: {} diadem: {} on: {}", checkpoint.height(), diadem.compactWrapped(),
+            log.info("Restored checkpoint: {} diadem: {} on: {}", checkpoint.height(), crown.compactWrapped(),
                      params.member().getId());
             checkpointState = cps;
         });
diff --git a/pom.xml b/pom.xml
index f09238cf9..fd128c7ac 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,7 +39,7 @@
         <dropwizard.version>4.0.5</dropwizard.version>
         <h2.version>2.2.220</h2.version>
         <jooq.version>3.17.2</jooq.version>
-        <bc.version>1.74</bc.version>
+        <bc.version>1.78</bc.version>
         <logback.version>1.4.12</logback.version>
         <grpc.version>1.62.2</grpc.version>
         <protobuf.version>3.25.3</protobuf.version>
diff --git a/stereotomy/src/main/java/com/salesforce/apollo/stereotomy/StereotomyImpl.java b/stereotomy/src/main/java/com/salesforce/apollo/stereotomy/StereotomyImpl.java
index 39fdbe946..98805be16 100644
--- a/stereotomy/src/main/java/com/salesforce/apollo/stereotomy/StereotomyImpl.java
+++ b/stereotomy/src/main/java/com/salesforce/apollo/stereotomy/StereotomyImpl.java
@@ -548,13 +548,14 @@ public CertificateWithPrivateKey provision(Instant validFrom, Duration valid, Li
 
             var signature = signer.sign(qb64(new BasicIdentifier(keyPair.getPublic())));
 
-            var dn = new BcX500NameDnImpl(String.format("UID=%s, DC=%s", Base64.getUrlEncoder()
-                                                                               .encodeToString(
-                                                                               (getState().getIdentifier()
-                                                                                          .toIdent()
-                                                                                          .toByteArray())),
-                                                        Base64.getUrlEncoder()
-                                                              .encodeToString(signature.toSig().toByteArray())));
+            var formatted = String.format("UID=%s, DC=%s", Base64.getUrlEncoder()
+                                                                 .withoutPadding()
+                                                                 .encodeToString(
+                                                                 (getState().getIdentifier().toIdent().toByteArray())),
+                                          Base64.getUrlEncoder()
+                                                .withoutPadding()
+                                                .encodeToString(signature.toSig().toByteArray()));
+            var dn = new BcX500NameDnImpl(formatted);
 
             return new CertificateWithPrivateKey(
             Certificates.selfSign(false, dn, keyPair, validFrom, validFrom.plus(valid), extensions),