Integrated: 8359956: Support algorithm constraints and certificate checks in SunX509 key manager

[Artur Barashev]

On Fri, 2 May 2025 22:48:56 GMT, Artur Barashev <abarashev at openjdk.org> wrote:

> SunX509 key manager should support the same certificate checks that are supported by PKIX key manager.
> 
> Effectively there should be only 2 differences between 2 key managers:
> - PKIX supports multiple key stores through KeyStore.Builder interface while SunX509 supports only a single keystore.
> - SunX509 caches its whole key store on initialization thus improving performance. This means that subsequent modifications of the KeyStore have no effect on SunX509 KM, unlike PKIX .
> 
> **SUNX509 KeyManager performance before the change**
> Benchmark                                    (resume)  (tlsVersion)   Mode  Cnt      Score     Error  Units
> SSLHandshake.doHandshake      true       TLSv1.2  thrpt   15  19758.012 ± 758.237  ops/s
> SSLHandshake.doHandshake      true           TLS  thrpt   15   1861.695 ±  14.681  ops/s
> SSLHandshake.doHandshake     false       TLSv1.2  thrpt   15   **1186.962** ±  12.085  ops/s
> SSLHandshake.doHandshake     false           TLS  thrpt   15   **1056.288** ±   7.197  ops/s
> 
> **SUNX509 KeyManager performance after the change**
> Benchmark                 (resume)  (tlsVersion)   Mode  Cnt      Score     Error  Units
> SSLHandshake.doHandshake      true       TLSv1.2  thrpt   15  20954.399 ± 260.817  ops/s
> SSLHandshake.doHandshake      true           TLS  thrpt   15   1813.401 ±  13.917  ops/s
> SSLHandshake.doHandshake     false       TLSv1.2  thrpt   15   **1158.190** ±   6.023  ops/s
> SSLHandshake.doHandshake     false           TLS  thrpt   15   **1012.988** ±  10.943  ops/s

This pull request has now been integrated.

Changeset: e544cd99
Author:    Artur Barashev <abarashev at openjdk.org>
URL:       https://git.openjdk.org/jdk/commit/e544cd992099ef905266610c2c1456705cdc4587
Stats:     2483 lines in 17 files changed: 1743 ins; 629 del; 111 mod

8359956: Support algorithm constraints and certificate checks in SunX509 key manager

Reviewed-by: mullan

-------------

PR: https://git.openjdk.org/jdk/pull/25016