...
The simplest workaround may be to use the SUN JDK but an alternative is to endorse a modern version of xmlsec which doesn't have the bug. Do this by creating a directory (anywhere) and add commons-logging-1.1.1.jar and xmlsec-1.4.3.jar to that directory. Now start the aggregator with -Djava.endorsed.dirs=/the/directory.