There are a lot of CA certs in JDK releases. The bootstrap of SunJSSE provider is pretty slow now. It is reported it takes 5 seconds to instantiate an SSLEngine or SSLSocket instance. The number of certs in cacerts impact the performance a lot. It is only getting worse as more CAs are requesting us to add their root certs to the JRE. We may want to improve the loading and searching performance of cert store.