8297065: DerOutputStream operations should not throw IOExceptions

Reviewed-by: mullan, valeriep

src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,6 @@ import java.math.BigInteger;
 import java.security.KeyRep;
 import java.security.PrivateKey;
 import java.security.InvalidKeyException;
-import java.security.ProviderException;
 import javax.crypto.spec.DHParameterSpec;
 import sun.security.util.*;
 
@@ -44,7 +43,7 @@ import sun.security.util.*;
  *
  *
  * @see DHPublicKey
- * @see java.security.KeyAgreement
+ * @see javax.crypto.KeyAgreement
  */
 final class DHPrivateKey implements PrivateKey,
         javax.crypto.interfaces.DHPrivateKey, Serializable {
@@ -80,8 +79,6 @@ final class DHPrivateKey implements PrivateKey,
      * @param x the private value
      * @param p the prime modulus
      * @param g the base generator
-     *
-     * @throws ProviderException if the key cannot be encoded
      */
     DHPrivateKey(BigInteger x, BigInteger p, BigInteger g)
         throws InvalidKeyException {
@@ -97,24 +94,18 @@ final class DHPrivateKey implements PrivateKey,
      * @param p the prime modulus
      * @param g the base generator
      * @param l the private-value length
-     *
-     * @throws ProviderException if the key cannot be encoded
      */
     DHPrivateKey(BigInteger x, BigInteger p, BigInteger g, int l) {
         this.x = x;
         this.p = p;
         this.g = g;
         this.l = l;
-        try {
+        byte[] xbytes = x.toByteArray();
-            byte[] xbytes = x.toByteArray();
+        DerValue val = new DerValue(DerValue.tag_Integer, xbytes);
-            DerValue val = new DerValue(DerValue.tag_Integer, xbytes);
+        this.key = val.toByteArray();
-            this.key = val.toByteArray();
+        val.clear();
-            val.clear();
+        Arrays.fill(xbytes, (byte) 0);
-            Arrays.fill(xbytes, (byte)0);
+        encode();
-            encode();
-        } catch (IOException e) {
-            throw new ProviderException("Cannot produce ASN.1 encoding", e);
-        }
     }
 
     /**
@@ -221,46 +212,42 @@ final class DHPrivateKey implements PrivateKey,
      */
     private void encode() {
         if (this.encodedKey == null) {
-            try {
+            DerOutputStream tmp = new DerOutputStream();
-                DerOutputStream tmp = new DerOutputStream();
 
-                //
+            //
-                // version
+            // version
-                //
+            //
-                tmp.putInteger(PKCS8_VERSION);
+            tmp.putInteger(PKCS8_VERSION);
 
-                //
+            //
-                // privateKeyAlgorithm
+            // privateKeyAlgorithm
-                //
+            //
-                DerOutputStream algid = new DerOutputStream();
+            DerOutputStream algid = new DerOutputStream();
 
-                // store OID
+            // store OID
-                algid.putOID(DHPublicKey.DH_OID);
+            algid.putOID(DHPublicKey.DH_OID);
-                // encode parameters
+            // encode parameters
-                DerOutputStream params = new DerOutputStream();
+            DerOutputStream params = new DerOutputStream();
-                params.putInteger(this.p);
+            params.putInteger(this.p);
-                params.putInteger(this.g);
+            params.putInteger(this.g);
-                if (this.l != 0) {
+            if (this.l != 0) {
-                    params.putInteger(this.l);
+                params.putInteger(this.l);
-                }
-                // wrap parameters into SEQUENCE
-                DerValue paramSequence = new DerValue(DerValue.tag_Sequence,
-                                                      params.toByteArray());
-                // store parameter SEQUENCE in algid
-                algid.putDerValue(paramSequence);
-                // wrap algid into SEQUENCE
-                tmp.write(DerValue.tag_Sequence, algid);
-
-                // privateKey
-                tmp.putOctetString(this.key);
-
-                // make it a SEQUENCE
-                DerValue val = DerValue.wrap(DerValue.tag_Sequence, tmp);
-                this.encodedKey = val.toByteArray();
-                val.clear();
-            } catch (IOException e) {
-                throw new AssertionError(e);
             }
+            // wrap parameters into SEQUENCE
+            DerValue paramSequence = new DerValue(DerValue.tag_Sequence,
+                    params.toByteArray());
+            // store parameter SEQUENCE in algid
+            algid.putDerValue(paramSequence);
+            // wrap algid into SEQUENCE
+            tmp.write(DerValue.tag_Sequence, algid);
+
+            // privateKey
+            tmp.putOctetString(this.key);
+
+            // make it a SEQUENCE
+            DerValue val = DerValue.wrap(DerValue.tag_Sequence, tmp);
+            this.encodedKey = val.toByteArray();
+            val.clear();
         }
     }
 

src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@ import java.util.Objects;
 import java.math.BigInteger;
 import java.security.KeyRep;
 import java.security.InvalidKeyException;
-import java.security.ProviderException;
 import java.security.PublicKey;
 import javax.crypto.spec.DHParameterSpec;
 import sun.security.util.*;
@@ -97,21 +96,15 @@ javax.crypto.interfaces.DHPublicKey, Serializable {
      * @param p the prime modulus
      * @param g the base generator
      * @param l the private-value length
-     *
-     * @exception ProviderException if the key cannot be encoded
      */
     DHPublicKey(BigInteger y, BigInteger p, BigInteger g, int l) {
         this.y = y;
         this.p = p;
         this.g = g;
         this.l = l;
-        try {
+        this.key = new DerValue(DerValue.tag_Integer,
-            this.key = new DerValue(DerValue.tag_Integer,
+                this.y.toByteArray()).toByteArray();
-                                    this.y.toByteArray()).toByteArray();
+        this.encodedKey = getEncoded();
-            this.encodedKey = getEncoded();
-        } catch (IOException e) {
-            throw new ProviderException("Cannot produce ASN.1 encoding", e);
-        }
     }
 
     /**
@@ -201,39 +194,35 @@ javax.crypto.interfaces.DHPublicKey, Serializable {
      */
     public synchronized byte[] getEncoded() {
         if (this.encodedKey == null) {
-            try {
+            DerOutputStream algid = new DerOutputStream();
-                DerOutputStream algid = new DerOutputStream();
 
-                // store oid in algid
+            // store oid in algid
-                algid.putOID(DH_OID);
+            algid.putOID(DH_OID);
 
-                // encode parameters
+            // encode parameters
-                DerOutputStream params = new DerOutputStream();
+            DerOutputStream params = new DerOutputStream();
-                params.putInteger(this.p);
+            params.putInteger(this.p);
-                params.putInteger(this.g);
+            params.putInteger(this.g);
-                if (this.l != 0) {
+            if (this.l != 0) {
-                    params.putInteger(this.l);
+                params.putInteger(this.l);
-                }
-                // wrap parameters into SEQUENCE
-                DerValue paramSequence = new DerValue(DerValue.tag_Sequence,
-                                                      params.toByteArray());
-                // store parameter SEQUENCE in algid
-                algid.putDerValue(paramSequence);
-
-                // wrap algid into SEQUENCE, and store it in key encoding
-                DerOutputStream tmpDerKey = new DerOutputStream();
-                tmpDerKey.write(DerValue.tag_Sequence, algid);
-
-                // store key data
-                tmpDerKey.putBitString(this.key);
-
-                // wrap algid and key into SEQUENCE
-                DerOutputStream derKey = new DerOutputStream();
-                derKey.write(DerValue.tag_Sequence, tmpDerKey);
-                this.encodedKey = derKey.toByteArray();
-            } catch (IOException e) {
-                return null;
             }
+            // wrap parameters into SEQUENCE
+            DerValue paramSequence = new DerValue(DerValue.tag_Sequence,
+                    params.toByteArray());
+            // store parameter SEQUENCE in algid
+            algid.putDerValue(paramSequence);
+
+            // wrap algid into SEQUENCE, and store it in key encoding
+            DerOutputStream tmpDerKey = new DerOutputStream();
+            tmpDerKey.write(DerValue.tag_Sequence, algid);
+
+            // store key data
+            tmpDerKey.putBitString(this.key);
+
+            // wrap algid and key into SEQUENCE
+            DerOutputStream derKey = new DerOutputStream();
+            derKey.write(DerValue.tag_Sequence, tmpDerKey);
+            this.encodedKey = derKey.toByteArray();
         }
         return this.encodedKey.clone();
     }

src/java.base/share/classes/com/sun/crypto/provider/EncryptedPrivateKeyInfo.java

@@ -107,9 +107,7 @@ final class EncryptedPrivateKeyInfo {
     /**
      * Returns the ASN.1 encoding of this class.
      */
-    byte[] getEncoded()
+    byte[] getEncoded() {
-        throws IOException
-    {
         if (this.encoded != null) return this.encoded.clone();
 
         DerOutputStream out = new DerOutputStream();

src/java.base/share/classes/sun/security/pkcs/ContentInfo.java

@@ -35,7 +35,7 @@ import sun.security.util.*;
  * @author Benjamin Renaud
  */
 
-public class ContentInfo {
+public class ContentInfo implements DerEncoder {
 
     // pkcs7 pre-defined content types
     public static ObjectIdentifier PKCS7_OID =
@@ -166,7 +166,8 @@ public class ContentInfo {
         throw new IOException("content type is not DATA: " + contentType);
     }
 
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream contentDerCode;
         DerOutputStream seq;
 

src/java.base/share/classes/sun/security/pkcs/EncryptedPrivateKeyInfo.java

@@ -115,9 +115,7 @@ public class EncryptedPrivateKeyInfo {
     /**
      * Returns the ASN.1 encoding of this class.
      */
-    public byte[] getEncoded()
+    public byte[] getEncoded() {
-        throws IOException
-    {
         if (this.encoded != null) return this.encoded.clone();
 
         DerOutputStream out = new DerOutputStream();
@@ -141,20 +139,16 @@ public class EncryptedPrivateKeyInfo {
             return true;
         if (!(other instanceof EncryptedPrivateKeyInfo))
             return false;
-        try {
+        byte[] thisEncrInfo = this.getEncoded();
-            byte[] thisEncrInfo = this.getEncoded();
+        byte[] otherEncrInfo
-            byte[] otherEncrInfo
+                = ((EncryptedPrivateKeyInfo) other).getEncoded();
-                = ((EncryptedPrivateKeyInfo)other).getEncoded();
 
-            if (thisEncrInfo.length != otherEncrInfo.length)
+        if (thisEncrInfo.length != otherEncrInfo.length)
-                return false;
-            for (int i = 0; i < thisEncrInfo.length; i++)
-                 if (thisEncrInfo[i] != otherEncrInfo[i])
-                     return false;
-            return true;
-        } catch (IOException e) {
             return false;
-        }
+        for (int i = 0; i < thisEncrInfo.length; i++)
+            if (thisEncrInfo[i] != otherEncrInfo[i])
+                return false;
+        return true;
     }
 
     /**

src/java.base/share/classes/sun/security/pkcs/PKCS7.java

@@ -436,18 +436,6 @@ public class PKCS7 {
         }
     }
 
-    /**
-     * Encodes the signed data to an output stream.
-     *
-     * @param out the output stream to write the encoded data to.
-     * @exception IOException on encoding errors.
-     */
-    public void encodeSignedData(OutputStream out) throws IOException {
-        DerOutputStream derout = new DerOutputStream();
-        encodeSignedData(derout);
-        out.write(derout.toByteArray());
-    }
-
     /**
      * Encodes the signed data to a DerOutputStream.
      *
@@ -850,7 +838,7 @@ public class PKCS7 {
                 : new ContentInfo(content);
         PKCS7 pkcs7 = new PKCS7(algorithms, contentInfo,
                 signerChain, signerInfos);
-        ByteArrayOutputStream p7out = new ByteArrayOutputStream();
+        DerOutputStream p7out = new DerOutputStream();
         pkcs7.encodeSignedData(p7out);
 
         return p7out.toByteArray();

src/java.base/share/classes/sun/security/pkcs/PKCS8Key.java

@@ -198,8 +198,7 @@ public class PKCS8Key implements PrivateKey {
      * or {@code null} if an encoding error occurs.
      */
     public byte[] getEncoded() {
-        byte[] b = getEncodedInternal();
+        return getEncodedInternal().clone();
-        return (b == null) ? null : b.clone();
     }
 
     /**
@@ -213,21 +212,17 @@ public class PKCS8Key implements PrivateKey {
      * DER-encodes this key as a byte array stored inside this object
      * and return it.
      *
-     * @return the encoding, or null if there is an I/O error.
+     * @return the encoding
      */
     private synchronized byte[] getEncodedInternal() {
         if (encodedKey == null) {
-            try {
+            DerOutputStream tmp = new DerOutputStream();
-                DerOutputStream tmp = new DerOutputStream();
+            tmp.putInteger(V1);
-                tmp.putInteger(V1);
+            algid.encode(tmp);
-                algid.encode(tmp);
+            tmp.putOctetString(key);
-                tmp.putOctetString(key);
+            DerValue out = DerValue.wrap(DerValue.tag_Sequence, tmp);
-                DerValue out = DerValue.wrap(DerValue.tag_Sequence, tmp);
+            encodedKey = out.toByteArray();
-                encodedKey = out.toByteArray();
+            out.clear();
-                out.clear();
-            } catch (IOException e) {
-                // encodedKey is still null
-            }
         }
         return encodedKey;
     }

src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java

@@ -26,7 +26,6 @@
 package sun.security.pkcs;
 
 import java.io.IOException;
-import java.security.cert.CertificateException;
 import java.util.Date;
 
 import sun.security.x509.CertificateExtensions;
@@ -530,12 +529,12 @@ public class PKCS9Attribute implements DerEncoder {
      * should be encoded as <code>T61String</code>s.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         DerOutputStream temp = new DerOutputStream();
         temp.putOID(oid);
         switch (index) {
         case -1:    // Unknown
-            temp.write((byte[])value);
+            temp.writeBytes((byte[])value);
             break;
         case 1:     // email address
         case 2:     // unstructured name

src/java.base/share/classes/sun/security/pkcs/PKCS9Attributes.java

@@ -26,7 +26,6 @@
 package sun.security.pkcs;
 
 import java.io.IOException;
-import java.io.OutputStream;
 import java.util.Hashtable;
 
 import sun.security.util.DerEncoder;
@@ -155,7 +154,7 @@ public class PKCS9Attributes {
      * @see PKCS9Attribute
      */
     public PKCS9Attributes(PKCS9Attribute[] attribs)
-    throws IllegalArgumentException, IOException {
+            throws IllegalArgumentException {
         ObjectIdentifier oid;
         for (int i=0; i < attribs.length; i++) {
             oid = attribs[i].getOID();
@@ -232,15 +231,13 @@ public class PKCS9Attributes {
      *
      * @param tag the implicit tag to use in the DER encoding.
      * @param out the output stream on which to put the DER encoding.
-     *
-     * @exception IOException  on output error.
      */
-    public void encode(byte tag, OutputStream out) throws IOException {
+    public void encode(byte tag, DerOutputStream out) {
         out.write(tag);
         out.write(derEncoding, 1, derEncoding.length -1);
     }
 
-    private byte[] generateDerEncoding() throws IOException {
+    private byte[] generateDerEncoding() {
         DerOutputStream out = new DerOutputStream();
         DerEncoder[] attribVals = attributes.values().toArray(new DerEncoder[0]);
         out.putOrderedSetOf(DerValue.tag_SetOf, attribVals);
@@ -251,7 +248,7 @@ public class PKCS9Attributes {
      * Return the DER encoding of this attribute set, tagged with
      * DerValue.tag_SetOf.
      */
-    public byte[] getDerEncoding() throws IOException {
+    public byte[] getDerEncoding() {
         return derEncoding.clone();
 
     }

src/java.base/share/classes/sun/security/pkcs/SignerInfo.java

@@ -212,13 +212,10 @@ public class SignerInfo implements DerEncoder {
      * DER encode this object onto an output stream.
      * Implements the {@code DerEncoder} interface.
      *
-     * @param out
+     * @param out the output stream on which to write the DER encoding.
-     * the output stream on which to write the DER encoding.
-     *
-     * @exception IOException on encoding error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         DerOutputStream seq = new DerOutputStream();
         seq.putInteger(version);
         DerOutputStream issuerAndSerialNumber = new DerOutputStream();
@@ -432,16 +429,11 @@ public class SignerInfo implements DerEncoder {
             boolean[] keyUsageBits = cert.getKeyUsage();
             if (keyUsageBits != null) {
                 KeyUsageExtension keyUsage;
-                try {
+                // We don't care whether this extension was marked
-                    // We don't care whether this extension was marked
+                // critical in the certificate.
-                    // critical in the certificate.
+                // We're interested only in its value (i.e., the bits set)
-                    // We're interested only in its value (i.e., the bits set)
+                // and treat the extension as critical.
-                    // and treat the extension as critical.
+                keyUsage = new KeyUsageExtension(keyUsageBits);
-                    keyUsage = new KeyUsageExtension(keyUsageBits);
-                } catch (IOException ioe) {
-                    throw new SignatureException("Failed to parse keyUsage "
-                                                 + "extension");
-                }
 
                 boolean digSigAllowed
                         = keyUsage.get(KeyUsageExtension.DIGITAL_SIGNATURE);

src/java.base/share/classes/sun/security/pkcs10/PKCS10.java

@@ -195,7 +195,7 @@ public class PKCS10 {
      * @exception InvalidKeyException key has a problem
      */
     public void encodeAndSign(X500Name subject, PrivateKey key, String algorithm)
-            throws IOException, SignatureException,
+            throws SignatureException,
                     NoSuchAlgorithmException, InvalidKeyException {
 
         DerOutputStream out, scratch;
@@ -217,7 +217,7 @@ public class PKCS10 {
         scratch = new DerOutputStream();
         scratch.putInteger(BigInteger.ZERO);            // PKCS #10 v1.0
         subject.encode(scratch);                        // X.500 name
-        scratch.write(subjectPublicKeyInfo.getEncoded()); // public key
+        scratch.writeBytes(subjectPublicKeyInfo.getEncoded()); // public key
         attributeSet.encode(scratch);
 
         out = new DerOutputStream();

src/java.base/share/classes/sun/security/pkcs10/PKCS10Attribute.java

@@ -102,13 +102,10 @@ public class PKCS10Attribute implements DerEncoder {
      * DER encode this object onto an output stream.
      * Implements the <code>DerEncoder</code> interface.
      *
-     * @param out
+     * @param out the DerOutputStream on which to write the DER encoding.
-     * the OutputStream on which to write the DER encoding.
-     *
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         PKCS9Attribute attr = new PKCS9Attribute(attributeId, attributeValue);
         attr.encode(out);
     }

src/java.base/share/classes/sun/security/pkcs10/PKCS10Attributes.java

@@ -91,11 +91,10 @@ public class PKCS10Attributes implements DerEncoder {
      * Encode the attributes in DER form to the stream.
      * Implements the {@code DerEncoder} interface.
      *
-     * @param out the OutputStream to marshal the contents to.
+     * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         // first copy the elements into an array
         Collection<PKCS10Attribute> allAttrs = map.values();
         PKCS10Attribute[] attribs =

src/java.base/share/classes/sun/security/pkcs12/MacData.java

@@ -138,7 +138,7 @@ class MacData {
      * @exception IOException if error occurs when constructing its
      * ASN.1 encoding.
      */
-    public byte[] getEncoded() throws NoSuchAlgorithmException, IOException
+    public byte[] getEncoded() throws NoSuchAlgorithmException
     {
         if (this.encoded != null)
             return this.encoded.clone();

src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java

@@ -829,38 +829,6 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
         return algParams;
     }
 
-    /*
-     * parse Algorithm Parameters
-     */
-    private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
-        DerInputStream in) throws IOException
-    {
-        AlgorithmParameters algParams = null;
-        try {
-            DerValue params;
-            if (in.available() == 0) {
-                params = null;
-            } else {
-                params = in.getDerValue();
-                if (params.tag == DerValue.tag_Null) {
-                   params = null;
-                }
-            }
-            if (params != null) {
-                if (algorithm.equals(pbes2_OID)) {
-                    algParams = AlgorithmParameters.getInstance("PBES2");
-                } else {
-                    algParams = AlgorithmParameters.getInstance("PBE");
-                }
-                algParams.init(params.toByteArray());
-            }
-        } catch (Exception e) {
-           throw new IOException("parseAlgParameters failed: " +
-                                 e.getMessage(), e);
-        }
-        return algParams;
-    }
-
     /*
      * Generate PBE key
      */
@@ -1206,7 +1174,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
         DerOutputStream version = new DerOutputStream();
         version.putInteger(VERSION_3);
         byte[] pfxVersion = version.toByteArray();
-        pfx.write(pfxVersion);
+        pfx.writeBytes(pfxVersion);
 
         // -- Create AuthSafe
         DerOutputStream authSafe = new DerOutputStream();
@@ -1247,7 +1215,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
                 // -- SEQUENCE of EncryptedData
                 DerOutputStream encrData = new DerOutputStream();
                 encrData.putInteger(0);
-                encrData.write(encryptContent(certsData, password));
+                encrData.writeBytes(encryptContent(certsData, password));
                 DerOutputStream encrDataContent = new DerOutputStream();
                 encrDataContent.write(DerValue.tag_Sequence, encrData);
                 ContentInfo encrContentInfo =
@@ -1269,7 +1237,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
         ContentInfo contentInfo = new ContentInfo(authenticatedSafe);
         contentInfo.encode(authSafe);
         byte[] authSafeData = authSafe.toByteArray();
-        pfx.write(authSafeData);
+        pfx.writeBytes(authSafeData);
 
         // -- MAC
         if (macAlgorithm == null) {
@@ -1615,13 +1583,13 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
      * add it, and assign it to the DN of the cert.
      */
     private byte[] getBagAttributes(String alias, byte[] keyId,
-        Set<KeyStore.Entry.Attribute> attributes) throws IOException {
+        Set<KeyStore.Entry.Attribute> attributes) {
         return getBagAttributes(alias, keyId, null, attributes);
     }
 
     private byte[] getBagAttributes(String alias, byte[] keyId,
         ObjectIdentifier[] trustedUsage,
-        Set<KeyStore.Entry.Attribute> attributes) throws IOException {
+        Set<KeyStore.Entry.Attribute> attributes) {
 
         byte[] localKeyID = null;
         byte[] friendlyName = null;
@@ -1675,13 +1643,13 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
 
         DerOutputStream attrs = new DerOutputStream();
         if (friendlyName != null) {
-            attrs.write(friendlyName);
+            attrs.writeBytes(friendlyName);
         }
         if (localKeyID != null) {
-            attrs.write(localKeyID);
+            attrs.writeBytes(localKeyID);
         }
         if (trustedKeyUsage != null) {
-            attrs.write(trustedKeyUsage);
+            attrs.writeBytes(trustedKeyUsage);
         }
 
         if (attributes != null) {
@@ -1693,7 +1661,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
                     CORE_ATTRIBUTES[2].value().equals(attributeName)) {
                     continue;
                 }
-                attrs.write(((PKCS12Attribute) attribute).getEncoded());
+                attrs.writeBytes(((PKCS12Attribute) attribute).getEncoded());
             }
         }
 
@@ -1706,9 +1674,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
      * SafeBags of type CertBag. Each CertBag may include pkcs12 attributes
      * (see comments in getBagAttributes)
      */
-    private byte[] getCertificateData()
+    private byte[] getCertificateData() throws CertificateException {
-        throws CertificateException, IOException
-    {
         DerOutputStream out = new DerOutputStream();
         for (Enumeration<String> e = engineAliases(); e.hasMoreElements(); ) {
 
@@ -1750,7 +1716,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
 
                 // Wrap the CertBag encoding in a context-specific tag.
                 DerOutputStream bagValue = new DerOutputStream();
-                bagValue.write(certBagValue);
+                bagValue.writeBytes(certBagValue);
                 // write SafeBag Value
                 safeBag.write(DerValue.createTag(DerValue.TAG_CONTEXT,
                                 true, (byte) 0), bagValue);
@@ -1784,7 +1750,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
                             entry.attributes);
                 }
                 if (bagAttrs != null) {
-                    safeBag.write(bagAttrs);
+                    safeBag.writeBytes(bagAttrs);
                 }
 
                 // wrap as Sequence
@@ -1836,7 +1802,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
 
                 // Wrap the EncryptedPrivateKeyInfo in a context-specific tag.
                 DerOutputStream bagValue = new DerOutputStream();
-                bagValue.write(encrInfo.getEncoded());
+                bagValue.writeBytes(encrInfo.getEncoded());
                 safeBag.write(DerValue.createTag(DerValue.TAG_CONTEXT,
                                 true, (byte) 0), bagValue);
 
@@ -1863,7 +1829,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
 
                 // Wrap the secret bag in a context-specific tag.
                 DerOutputStream bagValue = new DerOutputStream();
-                bagValue.write(secretBagValue);
+                bagValue.writeBytes(secretBagValue);
 
                 // Write SafeBag value
                 safeBag.write(DerValue.createTag(DerValue.TAG_CONTEXT,
@@ -1875,7 +1841,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
             // write SafeBag Attributes
             byte[] bagAttrs =
                 getBagAttributes(alias, entry.keyId, entry.attributes);
-            safeBag.write(bagAttrs);
+            safeBag.writeBytes(bagAttrs);
 
             // wrap as Sequence
             out.write(DerValue.tag_Sequence, safeBag);
@@ -1931,7 +1897,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
             // create EncryptedContentInfo
             DerOutputStream bytes2 = new DerOutputStream();
             bytes2.putOID(ContentInfo.DATA_OID);
-            bytes2.write(encodedAlgId);
+            bytes2.writeBytes(encodedAlgId);
 
             // Wrap encrypted data in a context-specific tag.
             DerOutputStream tmpout2 = new DerOutputStream();

src/java.base/share/classes/sun/security/provider/DSA.java

@@ -260,18 +260,13 @@ abstract class DSA extends SignatureSpi {
             return outseq;
         } else {
             // Return the DER-encoded ASN.1 form
-            try {
+            DerOutputStream outseq = new DerOutputStream(100);
-                DerOutputStream outseq = new DerOutputStream(100);
+            outseq.putInteger(r);
-                outseq.putInteger(r);
+            outseq.putInteger(s);
-                outseq.putInteger(s);
+            DerValue result = new DerValue(DerValue.tag_Sequence,
-                DerValue result = new DerValue(DerValue.tag_Sequence,
+                    outseq.toByteArray());
-                        outseq.toByteArray());
 
-                return result.toByteArray();
+            return result.toByteArray();
-
-            } catch (IOException e) {
-                throw new SignatureException("error encoding signature");
-            }
         }
     }
 

src/java.base/share/classes/sun/security/provider/DSAPrivateKey.java

@@ -68,15 +68,11 @@ public final class DSAPrivateKey extends PKCS8Key
         this.x = x;
         algid = new AlgIdDSA(p, q, g);
 
-        try {
+        byte[] xbytes = x.toByteArray();
-            byte[] xbytes = x.toByteArray();
+        DerValue val = new DerValue(DerValue.tag_Integer, xbytes);
-            DerValue val = new DerValue(DerValue.tag_Integer, xbytes);
+        key = val.toByteArray();
-            key = val.toByteArray();
+        val.clear();
-            val.clear();
+        Arrays.fill(xbytes, (byte)0);
-            Arrays.fill(xbytes, (byte)0);
-        } catch (IOException e) {
-            throw new AssertionError("Should not happen", e);
-        }
     }
 
     /**

src/java.base/share/classes/sun/security/provider/DSAPublicKey.java

@@ -82,20 +82,14 @@ implements java.security.interfaces.DSAPublicKey, Serializable {
      * @param g DSA parameter g, may be null if all of p, q, and g are null.
      */
     public DSAPublicKey(BigInteger y, BigInteger p, BigInteger q,
-                        BigInteger g)
+                        BigInteger g) {
-    throws InvalidKeyException {
         this.y = y;
         algid = new AlgIdDSA(p, q, g);
 
-        try {
+        byte[] keyArray = new DerValue(DerValue.tag_Integer,
-            byte[] keyArray = new DerValue(DerValue.tag_Integer,
+                           y.toByteArray()).toByteArray();
-                               y.toByteArray()).toByteArray();
+        setKey(new BitArray(keyArray.length*8, keyArray));
-            setKey(new BitArray(keyArray.length*8, keyArray));
+        encode();
-            encode();
-        } catch (IOException e) {
-            throw new InvalidKeyException("could not DER encode y: " +
-                                          e.getMessage());
-        }
     }
 
     /**

src/java.base/share/classes/sun/security/provider/KeyProtector.java

@@ -205,14 +205,9 @@ final class KeyProtector {
 
         // wrap the protected private key in a PKCS#8-style
         // EncryptedPrivateKeyInfo, and returns its encoding
-        AlgorithmId encrAlg;
+        AlgorithmId encrAlg = new AlgorithmId(ObjectIdentifier.of
-        try {
+                (KnownOIDs.JAVASOFT_JDKKeyProtector));
-            encrAlg = new AlgorithmId(ObjectIdentifier.of
+        return new EncryptedPrivateKeyInfo(encrAlg,encrKey).getEncoded();
-                    (KnownOIDs.JAVASOFT_JDKKeyProtector));
-            return new EncryptedPrivateKeyInfo(encrAlg,encrKey).getEncoded();
-        } catch (IOException ioe) {
-            throw new KeyStoreException(ioe.getMessage());
-        }
     }
 
     /*

src/java.base/share/classes/sun/security/provider/certpath/CertId.java

@@ -55,7 +55,7 @@ import sun.security.util.*;
  * @author      Ram Marti
  */
 
-public class CertId {
+public class CertId implements DerEncoder {
 
     private static final boolean debug = false;
     private static final AlgorithmId SHA1_ALGID
@@ -154,7 +154,8 @@ public class CertId {
      * Encode the CertId using ASN.1 DER.
      * The hash algorithm used is SHA-1.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
 
         DerOutputStream tmp = new DerOutputStream();
         hashAlgId.encode(tmp);

src/java.base/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java

@@ -199,49 +199,44 @@ public final class RSAPrivateCrtKeyImpl
         this.type = type;
         this.keyParams = keyParams;
 
-        try {
+        byte[][] nbytes = new byte[8][];
-            byte[][] nbytes = new byte[8][];
+        nbytes[0] = n.toByteArray();
-            nbytes[0] = n.toByteArray();
+        nbytes[1] = e.toByteArray();
-            nbytes[1] = e.toByteArray();
+        nbytes[2] = d.toByteArray();
-            nbytes[2] = d.toByteArray();
+        nbytes[3] = p.toByteArray();
-            nbytes[3] = p.toByteArray();
+        nbytes[4] = q.toByteArray();
-            nbytes[4] = q.toByteArray();
+        nbytes[5] = pe.toByteArray();
-            nbytes[5] = pe.toByteArray();
+        nbytes[6] = qe.toByteArray();
-            nbytes[6] = qe.toByteArray();
+        nbytes[7] = coeff.toByteArray();
-            nbytes[7] = coeff.toByteArray();
 
-            // Initiate with a big enough size so there's no need to
+        // Initiate with a big enough size so there's no need to
-            // reallocate memory later and thus can be cleaned up
+        // reallocate memory later and thus can be cleaned up
-            // reliably.
+        // reliably.
-            DerOutputStream out = new DerOutputStream(
+        DerOutputStream out = new DerOutputStream(
-                    nbytes[0].length + nbytes[1].length +
+                nbytes[0].length + nbytes[1].length +
-                    nbytes[2].length + nbytes[3].length +
+                        nbytes[2].length + nbytes[3].length +
-                    nbytes[4].length + nbytes[5].length +
+                        nbytes[4].length + nbytes[5].length +
-                    nbytes[6].length + nbytes[7].length +
+                        nbytes[6].length + nbytes[7].length +
-                    100); // Enough for version(3) and 8 tag+length(3 or 4)
+                        100); // Enough for version(3) and 8 tag+length(3 or 4)
-            out.putInteger(0); // version must be 0
+        out.putInteger(0); // version must be 0
-            out.putInteger(nbytes[0]);
+        out.putInteger(nbytes[0]);
-            out.putInteger(nbytes[1]);
+        out.putInteger(nbytes[1]);
-            out.putInteger(nbytes[2]);
+        out.putInteger(nbytes[2]);
-            out.putInteger(nbytes[3]);
+        out.putInteger(nbytes[3]);
-            out.putInteger(nbytes[4]);
+        out.putInteger(nbytes[4]);
-            out.putInteger(nbytes[5]);
+        out.putInteger(nbytes[5]);
-            out.putInteger(nbytes[6]);
+        out.putInteger(nbytes[6]);
-            out.putInteger(nbytes[7]);
+        out.putInteger(nbytes[7]);
-            // Private values from [2] on.
+        // Private values from [2] on.
-            Arrays.fill(nbytes[2], (byte)0);
+        Arrays.fill(nbytes[2], (byte) 0);
-            Arrays.fill(nbytes[3], (byte)0);
+        Arrays.fill(nbytes[3], (byte) 0);
-            Arrays.fill(nbytes[4], (byte)0);
+        Arrays.fill(nbytes[4], (byte) 0);
-            Arrays.fill(nbytes[5], (byte)0);
+        Arrays.fill(nbytes[5], (byte) 0);
-            Arrays.fill(nbytes[6], (byte)0);
+        Arrays.fill(nbytes[6], (byte) 0);
-            Arrays.fill(nbytes[7], (byte)0);
+        Arrays.fill(nbytes[7], (byte) 0);
-            DerValue val = DerValue.wrap(DerValue.tag_Sequence, out);
+        DerValue val = DerValue.wrap(DerValue.tag_Sequence, out);
-            key = val.toByteArray();
+        key = val.toByteArray();
-            val.clear();
+        val.clear();
-        } catch (IOException exc) {
-            // should never occur
-            throw new InvalidKeyException(exc);
-        }
     }
 
     // see JCA doc

src/java.base/share/classes/sun/security/rsa/RSAPrivateKeyImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,7 +25,6 @@
 
 package sun.security.rsa;
 
-import java.io.IOException;
 import java.math.BigInteger;
 
 import java.security.*;
@@ -89,31 +88,26 @@ public final class RSAPrivateKeyImpl extends PKCS8Key implements RSAPrivateKey {
         this.type = type;
         this.keyParams = keyParams;
 
-        try {
+        // generate the key encoding
-            // generate the key encoding
+        byte[] nbytes = n.toByteArray();
-            byte[] nbytes = n.toByteArray();
+        byte[] dbytes = d.toByteArray();
-            byte[] dbytes = d.toByteArray();
+        DerOutputStream out = new DerOutputStream(
-            DerOutputStream out = new DerOutputStream(
+                nbytes.length + dbytes.length + 50);
-                    nbytes.length + dbytes.length + 50);
+        // Enough for 7 zeroes (21) and 2 tag+length(4)
-                    // Enough for 7 zeroes (21) and 2 tag+length(4)
+        out.putInteger(0); // version must be 0
-            out.putInteger(0); // version must be 0
+        out.putInteger(nbytes);
-            out.putInteger(nbytes);
+        Arrays.fill(nbytes, (byte) 0);
-            Arrays.fill(nbytes, (byte)0);
+        out.putInteger(0);
-            out.putInteger(0);
+        out.putInteger(dbytes);
-            out.putInteger(dbytes);
+        Arrays.fill(dbytes, (byte) 0);
-            Arrays.fill(dbytes, (byte)0);
+        out.putInteger(0);
-            out.putInteger(0);
+        out.putInteger(0);
-            out.putInteger(0);
+        out.putInteger(0);
-            out.putInteger(0);
+        out.putInteger(0);
-            out.putInteger(0);
+        out.putInteger(0);
-            out.putInteger(0);
+        DerValue val = DerValue.wrap(DerValue.tag_Sequence, out);
-            DerValue val = DerValue.wrap(DerValue.tag_Sequence, out);
+        key = val.toByteArray();
-            key = val.toByteArray();
+        val.clear();
-            val.clear();
-        } catch (IOException exc) {
-            // should never occur
-            throw new InvalidKeyException(exc);
-        }
     }
 
     // see JCA doc

src/java.base/share/classes/sun/security/rsa/RSAPublicKeyImpl.java

@@ -126,19 +126,14 @@ public final class RSAPublicKeyImpl extends X509Key implements RSAPublicKey {
         this.type = type;
         this.keyParams = keyParams;
 
-        try {
+        // generate the key encoding
-            // generate the key encoding
+        DerOutputStream out = new DerOutputStream();
-            DerOutputStream out = new DerOutputStream();
+        out.putInteger(n);
-            out.putInteger(n);
+        out.putInteger(e);
-            out.putInteger(e);
+        byte[] keyArray =
-            byte[] keyArray =
                 new DerValue(DerValue.tag_Sequence,
-                             out.toByteArray()).toByteArray();
+                        out.toByteArray()).toByteArray();
-            setKey(new BitArray(keyArray.length*8, keyArray));
+        setKey(new BitArray(keyArray.length * 8, keyArray));
-        } catch (IOException exc) {
-            // should never occur
-            throw new InvalidKeyException(exc);
-        }
     }
 
     /**

src/java.base/share/classes/sun/security/rsa/RSASignature.java

@@ -193,8 +193,6 @@ abstract class RSASignature extends SignatureSpi {
             return RSACore.rsa(padded, privateKey, true);
         } catch (GeneralSecurityException e) {
             throw new SignatureException("Could not sign data", e);
-        } catch (IOException e) {
-            throw new SignatureException("Could not encode data", e);
         }
     }
 

src/java.base/share/classes/sun/security/rsa/RSAUtil.java

@@ -170,8 +170,7 @@ public class RSAUtil {
      * Encode the digest, return the to-be-signed data.
      * Also used by the PKCS#11 provider.
      */
-    public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
+    public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest) {
-            throws IOException {
         DerOutputStream out = new DerOutputStream();
         new AlgorithmId(oid).encode(out);
         out.putOctetString(digest);

src/java.base/share/classes/sun/security/util/DerEncoder.java

@@ -25,8 +25,6 @@
 
 package sun.security.util;
 
-import java.io.IOException;
-
 /**
  * Interface to an object that knows how to write its own DER
  * encoding to an output stream.
@@ -40,7 +38,6 @@ public interface DerEncoder {
      *
      * @param out  the stream on which the DER encoding is written.
      */
-    void encode(DerOutputStream out)
+    void encode(DerOutputStream out);
-        throws IOException;
 
 }

src/java.base/share/classes/sun/security/util/DerOutputStream.java

@@ -26,7 +26,6 @@
 package sun.security.util;
 
 import java.io.ByteArrayOutputStream;
-import java.io.IOException;
 import java.math.BigInteger;
 import java.nio.charset.Charset;
 import java.text.SimpleDateFormat;
@@ -55,8 +54,8 @@ import static java.nio.charset.StandardCharsets.UTF_8;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public class DerOutputStream
+public final class DerOutputStream
-extends ByteArrayOutputStream implements DerEncoder {
+        extends ByteArrayOutputStream implements DerEncoder {
     /**
      * Construct a DER output stream.
      *
@@ -78,10 +77,10 @@ extends ByteArrayOutputStream implements DerEncoder {
      *          <em>DerValue.tag_Sequence</em>
      * @param buf buffered data, which must be DER-encoded
      */
-    public DerOutputStream write(byte tag, byte[] buf) throws IOException {
+    public DerOutputStream write(byte tag, byte[] buf) {
         write(tag);
         putLength(buf.length);
-        write(buf, 0, buf.length);
+        writeBytes(buf);
         return this;
     }
 
@@ -94,7 +93,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      *          <em>DerValue.tag_Sequence</em>
      * @param out buffered data
      */
-    public DerOutputStream write(byte tag, DerOutputStream out) throws IOException {
+    public DerOutputStream write(byte tag, DerOutputStream out) {
         write(tag);
         putLength(out.count);
         write(out.buf, 0, out.count);
@@ -118,8 +117,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * explicit tagging the form is always constructed.
      * @param value original value being implicitly tagged
      */
-    public DerOutputStream writeImplicit(byte tag, DerOutputStream value)
+    public DerOutputStream writeImplicit(byte tag, DerOutputStream value) {
-    throws IOException {
         write(tag);
         write(value.buf, 1, value.count-1);
         return this;
@@ -128,7 +126,7 @@ extends ByteArrayOutputStream implements DerEncoder {
     /**
      * Marshals pre-encoded DER value onto the output stream.
      */
-    public DerOutputStream putDerValue(DerValue val) throws IOException {
+    public DerOutputStream putDerValue(DerValue val) {
         val.encode(this);
         return this;
     }
@@ -144,7 +142,7 @@ extends ByteArrayOutputStream implements DerEncoder {
     /**
      * Marshals a DER boolean on the output stream.
      */
-    public DerOutputStream putBoolean(boolean val) throws IOException {
+    public DerOutputStream putBoolean(boolean val) {
         write(DerValue.tag_Boolean);
         putLength(1);
         if (val) {
@@ -159,7 +157,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * Marshals a DER enumerated on the output stream.
      * @param i the enumerated value.
      */
-    public DerOutputStream putEnumerated(int i) throws IOException {
+    public DerOutputStream putEnumerated(int i) {
         write(DerValue.tag_Enumerated);
         putIntegerContents(i);
         return this;
@@ -170,11 +168,11 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * @param i the integer in the form of a BigInteger.
      */
-    public DerOutputStream putInteger(BigInteger i) throws IOException {
+    public DerOutputStream putInteger(BigInteger i) {
         write(DerValue.tag_Integer);
         byte[]    buf = i.toByteArray(); // least number  of bytes
         putLength(buf.length);
-        write(buf, 0, buf.length);
+        writeBytes(buf);
         return this;
     }
 
@@ -183,10 +181,10 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * @param buf the integer in bytes, equivalent to BigInteger::toByteArray.
      */
-    public DerOutputStream putInteger(byte[] buf) throws IOException {
+    public DerOutputStream putInteger(byte[] buf) {
         write(DerValue.tag_Integer);
         putLength(buf.length);
-        write(buf, 0, buf.length);
+        writeBytes(buf);
         return this;
     }
 
@@ -194,7 +192,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * Marshals a DER integer on the output stream.
      * @param i the integer in the form of an Integer.
      */
-    public DerOutputStream putInteger(Integer i) throws IOException {
+    public DerOutputStream putInteger(Integer i) {
         return putInteger(i.intValue());
     }
 
@@ -202,13 +200,13 @@ extends ByteArrayOutputStream implements DerEncoder {
      * Marshals a DER integer on the output stream.
      * @param i the integer.
      */
-    public DerOutputStream putInteger(int i) throws IOException {
+    public DerOutputStream putInteger(int i) {
         write(DerValue.tag_Integer);
         putIntegerContents(i);
         return this;
     }
 
-    private void putIntegerContents(int i) throws IOException {
+    private void putIntegerContents(int i) {
 
         byte[] bytes = new byte[4];
         int start = 0;
@@ -258,11 +256,11 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * @param bits the bit string, MSB first
      */
-    public DerOutputStream putBitString(byte[] bits) throws IOException {
+    public DerOutputStream putBitString(byte[] bits) {
         write(DerValue.tag_BitString);
         putLength(bits.length + 1);
         write(0);               // all of last octet is used
-        write(bits);
+        writeBytes(bits);
         return this;
     }
 
@@ -272,13 +270,13 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * @param ba the bit string, MSB first
      */
-    public DerOutputStream putUnalignedBitString(BitArray ba) throws IOException {
+    public DerOutputStream putUnalignedBitString(BitArray ba) {
         byte[] bits = ba.toByteArray();
 
         write(DerValue.tag_BitString);
         putLength(bits.length + 1);
         write(bits.length*8 - ba.length()); // excess bits in last octet
-        write(bits);
+        writeBytes(bits);
         return this;
     }
 
@@ -288,7 +286,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * @param ba the bit string, MSB first
      */
-    public DerOutputStream putTruncatedUnalignedBitString(BitArray ba) throws IOException {
+    public DerOutputStream putTruncatedUnalignedBitString(BitArray ba) {
         return putUnalignedBitString(ba.truncate());
     }
 
@@ -297,7 +295,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * @param octets the octet string
      */
-    public DerOutputStream putOctetString(byte[] octets) throws IOException {
+    public DerOutputStream putOctetString(byte[] octets) {
         return write(DerValue.tag_OctetString, octets);
     }
 
@@ -305,7 +303,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * Marshals a DER "null" value on the output stream.  These are
      * often used to indicate optional values which have been omitted.
      */
-    public DerOutputStream putNull() throws IOException {
+    public DerOutputStream putNull() {
         write(DerValue.tag_Null);
         putLength(0);
         return this;
@@ -315,7 +313,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * Marshals an object identifier (OID) on the output stream.
      * Corresponds to the ASN.1 "OBJECT IDENTIFIER" construct.
      */
-    public DerOutputStream putOID(ObjectIdentifier oid) throws IOException {
+    public DerOutputStream putOID(ObjectIdentifier oid) {
         oid.encode(this);
         return this;
     }
@@ -325,7 +323,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * the ASN.1 "SEQUENCE" (zero to N values) and "SEQUENCE OF"
      * (one to N values) constructs.
      */
-    public DerOutputStream putSequence(DerValue[] seq) throws IOException {
+    public DerOutputStream putSequence(DerValue[] seq) {
         DerOutputStream bytes = new DerOutputStream();
         int i;
 
@@ -342,7 +340,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      *
      * For DER encoding, use orderedPutSet() or orderedPutSetOf().
      */
-    public DerOutputStream putSet(DerValue[] set) throws IOException {
+    public DerOutputStream putSet(DerValue[] set) {
         DerOutputStream bytes = new DerOutputStream();
         int i;
 
@@ -362,7 +360,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * This method supports the ASN.1 "SET OF" construct, but not
      * "SET", which uses a different order.
      */
-    public DerOutputStream putOrderedSetOf(byte tag, DerEncoder[] set) throws IOException {
+    public DerOutputStream putOrderedSetOf(byte tag, DerEncoder[] set) {
         return putOrderedSet(tag, set, lexOrder);
     }
 
@@ -376,7 +374,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * This method supports the ASN.1 "SET" construct, but not
      * "SET OF", which uses a different order.
      */
-    public DerOutputStream putOrderedSet(byte tag, DerEncoder[] set) throws IOException {
+    public DerOutputStream putOrderedSet(byte tag, DerEncoder[] set) {
         return putOrderedSet(tag, set, tagOrder);
     }
 
@@ -399,7 +397,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * @param order the order to use when sorting encodings of components.
      */
     private DerOutputStream putOrderedSet(byte tag, DerEncoder[] set,
-                               Comparator<byte[]> order) throws IOException {
+                               Comparator<byte[]> order) {
         DerOutputStream[] streams = new DerOutputStream[set.length];
 
         for (int i = 0; i < set.length; i++) {
@@ -416,7 +414,7 @@ extends ByteArrayOutputStream implements DerEncoder {
 
         DerOutputStream bytes = new DerOutputStream();
         for (int i = 0; i < streams.length; i++) {
-            bytes.write(bufs[i]);
+            bytes.writeBytes(bufs[i]);
         }
         return write(tag, bytes);
     }
@@ -424,21 +422,21 @@ extends ByteArrayOutputStream implements DerEncoder {
     /**
      * Marshals a string as a DER encoded UTF8String.
      */
-    public DerOutputStream putUTF8String(String s) throws IOException {
+    public DerOutputStream putUTF8String(String s) {
         return writeString(s, DerValue.tag_UTF8String, UTF_8);
     }
 
     /**
      * Marshals a string as a DER encoded PrintableString.
      */
-    public DerOutputStream putPrintableString(String s) throws IOException {
+    public DerOutputStream putPrintableString(String s) {
         return writeString(s, DerValue.tag_PrintableString, US_ASCII);
     }
 
     /**
      * Marshals a string as a DER encoded T61String.
      */
-    public DerOutputStream putT61String(String s) throws IOException {
+    public DerOutputStream putT61String(String s) {
         /*
          * Works for characters that are defined in both ASCII and
          * T61.
@@ -449,21 +447,21 @@ extends ByteArrayOutputStream implements DerEncoder {
     /**
      * Marshals a string as a DER encoded IA5String.
      */
-    public DerOutputStream putIA5String(String s) throws IOException {
+    public DerOutputStream putIA5String(String s) {
         return writeString(s, DerValue.tag_IA5String, US_ASCII);
     }
 
     /**
      * Marshals a string as a DER encoded BMPString.
      */
-    public DerOutputStream putBMPString(String s) throws IOException {
+    public DerOutputStream putBMPString(String s) {
         return writeString(s, DerValue.tag_BMPString, UTF_16BE);
     }
 
     /**
      * Marshals a string as a DER encoded GeneralString.
      */
-    public DerOutputStream putGeneralString(String s) throws IOException {
+    public DerOutputStream putGeneralString(String s) {
         return writeString(s, DerValue.tag_GeneralString, US_ASCII);
     }
 
@@ -475,13 +473,12 @@ extends ByteArrayOutputStream implements DerEncoder {
      * @param charset the charset that should be used corresponding to
      * the above tag.
      */
-    private DerOutputStream writeString(String s, byte stringTag, Charset charset)
+    private DerOutputStream writeString(String s, byte stringTag, Charset charset) {
-        throws IOException {
 
         byte[] data = s.getBytes(charset);
         write(stringTag);
         putLength(data.length);
-        write(data);
+        writeBytes(data);
         return this;
     }
 
@@ -491,7 +488,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * <P>YYMMDDhhmmss{Z|+hhmm|-hhmm} ... emits only using Zulu time
      * and with seconds (even if seconds=0) as per RFC 5280.
      */
-    public DerOutputStream putUTCTime(Date d) throws IOException {
+    public DerOutputStream putUTCTime(Date d) {
         return putTime(d, DerValue.tag_UtcTime);
     }
 
@@ -501,7 +498,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * <P>YYYYMMDDhhmmss{Z|+hhmm|-hhmm} ... emits only using Zulu time
      * and with seconds (even if seconds=0) as per RFC 5280.
      */
-    public DerOutputStream putGeneralizedTime(Date d) throws IOException {
+    public DerOutputStream putGeneralizedTime(Date d) {
         return putTime(d, DerValue.tag_GeneralizedTime);
     }
 
@@ -512,7 +509,7 @@ extends ByteArrayOutputStream implements DerEncoder {
      * @param d the date to be marshalled
      * @param tag the tag for UTC Time or Generalized Time
      */
-    private DerOutputStream putTime(Date d, byte tag) throws IOException {
+    private DerOutputStream putTime(Date d, byte tag) {
 
         /*
          * Format the date.
@@ -538,7 +535,7 @@ extends ByteArrayOutputStream implements DerEncoder {
 
         write(tag);
         putLength(time.length);
-        write(time);
+        writeBytes(time);
         return this;
     }
 
@@ -546,9 +543,8 @@ extends ByteArrayOutputStream implements DerEncoder {
      * Put the encoding of the length in the stream.
      *
      * @param len the length of the attribute.
-     * @exception IOException on writing errors.
      */
-    public void putLength(int len) throws IOException {
+    public void putLength(int len) {
         if (len < 128) {
             write((byte)len);
 
@@ -579,20 +575,17 @@ extends ByteArrayOutputStream implements DerEncoder {
     /**
      *  Write the current contents of this <code>DerOutputStream</code>
      *  to an <code>OutputStream</code>.
-     *
-     *  @exception IOException on output error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
-        out.write(toByteArray());
+        out.writeBytes(toByteArray());
     }
 
     /**
      * Write a DerEncoder onto the output stream.
      * @param encoder the DerEncoder
-     * @throws IOException on output error
      */
-    public DerOutputStream write(DerEncoder encoder) throws IOException {
+    public DerOutputStream write(DerEncoder encoder) {
         encoder.encode(this);
         return this;
     }

src/java.base/share/classes/sun/security/util/DerValue.java

@@ -493,7 +493,7 @@ public class DerValue {
     /**
      * Encode an ASN1/DER encoded datum onto a DER output stream.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         out.write(tag);
         out.putLength(end - start);
         out.write(buffer, start, end - start);
@@ -774,7 +774,7 @@ public class DerValue {
      * Helper routine to return all the bytes contained in the
      * DerInputStream associated with this object.
      */
-    public byte[] getDataBytes() throws IOException {
+    public byte[] getDataBytes() {
         data.pos = data.end; // Compatibility. Reach end.
         return Arrays.copyOfRange(buffer, start, end);
     }
@@ -1133,7 +1133,7 @@ public class DerValue {
      *
      * @return DER-encoded value, including tag and length.
      */
-    public byte[] toByteArray() throws IOException {
+    public byte[] toByteArray() {
         data.pos = data.start; // Compatibility. At head.
         // Minimize content duplication by writing out tag and length only
         DerOutputStream out = new DerOutputStream();

src/java.base/share/classes/sun/security/util/NamedCurve.java

@@ -25,7 +25,6 @@
 
 package sun.security.util;
 
-import java.io.IOException;
 import java.math.BigInteger;
 import java.security.spec.ECParameterSpec;
 import java.security.spec.ECPoint;
@@ -59,11 +58,7 @@ public final class NamedCurve extends ECParameterSpec {
         this.oid = ko.value();
 
         DerOutputStream out = new DerOutputStream();
-        try {
+        out.putOID(ObjectIdentifier.of(ko));
-            out.putOID(ObjectIdentifier.of(ko));
-        } catch (IOException e) {
-            throw new RuntimeException("Internal error", e);
-        }
         encoded = out.toByteArray();
     }
 

src/java.base/share/classes/sun/security/util/ObjectIdentifier.java

@@ -324,7 +324,7 @@ public final class ObjectIdentifier implements Serializable {
     /*
      * n.b. the only public interface is DerOutputStream.putOID()
      */
-    void encode(DerOutputStream out) throws IOException {
+    void encode(DerOutputStream out) {
         out.write (DerValue.tag_ObjectId, encoding);
     }
 

src/java.base/share/classes/sun/security/x509/AVA.java

@@ -620,14 +620,11 @@ public class AVA implements DerEncoder {
      * DER encode this object onto an output stream.
      * Implements the <code>DerEncoder</code> interface.
      *
-     * @param out
+     * @param out the output stream on which to write the DER encoding.
-     * the output stream on which to write the DER encoding.
-     *
-     * @exception IOException on encoding error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
-        DerOutputStream         tmp = new DerOutputStream();
+        DerOutputStream tmp = new DerOutputStream();
 
         tmp.putOID(oid);
         value.encode(tmp);
@@ -705,12 +702,7 @@ public class AVA implements DerEncoder {
         if ((typeAndValue.charAt(0) >= '0' && typeAndValue.charAt(0) <= '9') ||
             !isDerString(value, false))
         {
-            byte[] data;
+            byte[] data = value.toByteArray();
-            try {
-                data = value.toByteArray();
-            } catch (IOException ie) {
-                throw new IllegalArgumentException("DER Value conversion");
-            }
             typeAndValue.append('#');
             HexFormat.of().formatHex(typeAndValue, data);
         } else {
@@ -722,12 +714,7 @@ public class AVA implements DerEncoder {
              * NOTE: this implementation only emits DirectoryStrings of the
              * types returned by isDerString().
              */
-            String valStr;
+            String valStr = new String(value.getDataBytes(), UTF_8);
-            try {
-                valStr = new String(value.getDataBytes(), UTF_8);
-            } catch (IOException ie) {
-                throw new IllegalArgumentException("DER Value conversion");
-            }
 
             /*
              * 2.4 (cont): If the UTF-8 string does not have any of the
@@ -840,12 +827,7 @@ public class AVA implements DerEncoder {
         if ((typeAndValue.charAt(0) >= '0' && typeAndValue.charAt(0) <= '9') ||
             !isDerString(value, true))
         {
-            byte[] data;
+            byte[] data = value.toByteArray();
-            try {
-                data = value.toByteArray();
-            } catch (IOException ie) {
-                throw new IllegalArgumentException("DER Value conversion");
-            }
             typeAndValue.append('#');
             HexFormat.of().formatHex(typeAndValue, data);
         } else {
@@ -857,12 +839,7 @@ public class AVA implements DerEncoder {
              * NOTE: this implementation only emits DirectoryStrings of the
              * types returned by isDerString().
              */
-            String valStr;
+            String valStr = new String(value.getDataBytes(), UTF_8);
-            try {
-                valStr = new String(value.getDataBytes(), UTF_8);
-            } catch (IOException ie) {
-                throw new IllegalArgumentException("DER Value conversion");
-            }
 
             /*
              * 2.4 (cont): If the UTF-8 string does not have any of the

src/java.base/share/classes/sun/security/x509/AccessDescription.java

@@ -72,7 +72,7 @@ public final class AccessDescription {
         return accessLocation;
     }
 
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         DerOutputStream tmp = new DerOutputStream();
         tmp.putOID(accessMethod);
         accessLocation.encode(tmp);

src/java.base/share/classes/sun/security/x509/AlgorithmId.java

@@ -153,13 +153,10 @@ public class AlgorithmId implements Serializable, DerEncoder {
      * DER encode this object onto an output stream.
      * Implements the <code>DerEncoder</code> interface.
      *
-     * @param out
+     * @param out the output stream on which to write the DER encoding.
-     * the output stream on which to write the DER encoding.
-     *
-     * @exception IOException on encoding error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         DerOutputStream bytes = new DerOutputStream();
 
         bytes.putOID(algid);
@@ -220,7 +217,7 @@ public class AlgorithmId implements Serializable, DerEncoder {
                 bytes.putNull();
             }
         } else {
-            bytes.write(encodedParams);
+            bytes.writeBytes(encodedParams);
         }
         out.write(DerValue.tag_Sequence, bytes);
     }
@@ -229,7 +226,7 @@ public class AlgorithmId implements Serializable, DerEncoder {
     /**
      * Returns the DER-encoded X.509 AlgorithmId as a byte array.
      */
-    public final byte[] encode() throws IOException {
+    public final byte[] encode() {
         DerOutputStream out = new DerOutputStream();
         encode(out);
         return out.toByteArray();

src/java.base/share/classes/sun/security/x509/AuthorityInfoAccessExtension.java

@@ -76,10 +76,9 @@ public class AuthorityInfoAccessExtension extends Extension {
      *
      * @param accessDescriptions the List of AccessDescription,
      *                           cannot be null or empty.
-     * @throws IOException on error
      */
     public AuthorityInfoAccessExtension(
-            List<AccessDescription> accessDescriptions) throws IOException {
+            List<AccessDescription> accessDescriptions) {
         if (accessDescriptions == null || accessDescriptions.isEmpty()) {
             throw new IllegalArgumentException("accessDescriptions is null or empty");
         }
@@ -138,10 +137,9 @@ public class AuthorityInfoAccessExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = PKIXExtensions.AuthInfoAccess_Id;
             this.critical = false;
@@ -151,7 +149,7 @@ public class AuthorityInfoAccessExtension extends Extension {
     }
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (accessDescriptions.isEmpty()) {
             this.extensionValue = null;
         } else {

src/java.base/share/classes/sun/security/x509/AuthorityKeyIdentifierExtension.java

@@ -65,7 +65,7 @@ public class AuthorityKeyIdentifierExtension extends Extension {
     private SerialNumber        serialNum = null;
 
     // Encode only the extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (id == null && names == null && serialNum == null) {
             this.extensionValue = null;
             return;
@@ -78,15 +78,11 @@ public class AuthorityKeyIdentifierExtension extends Extension {
             tmp.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT,
                               false, TAG_ID), tmp1);
         }
-        try {
+        if (names != null) {
-            if (names != null) {
+            DerOutputStream tmp1 = new DerOutputStream();
-                DerOutputStream tmp1 = new DerOutputStream();
+            names.encode(tmp1);
-                names.encode(tmp1);
+            tmp.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT,
-                tmp.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT,
+                              true, TAG_NAMES), tmp1);
-                                  true, TAG_NAMES), tmp1);
-            }
-        } catch (Exception e) {
-            throw new IOException(e.toString());
         }
         if (serialNum != null) {
             DerOutputStream tmp1 = new DerOutputStream();
@@ -106,11 +102,9 @@ public class AuthorityKeyIdentifierExtension extends Extension {
      * @param names the GeneralNames associated with this extension
      * @param sn the CertificateSerialNumber associated with
      *        this extension.
-     * @exception IOException on error.
      */
     public AuthorityKeyIdentifierExtension(KeyIdentifier kid, GeneralNames names,
-                                           SerialNumber sn)
+                                           SerialNumber sn) {
-            throws IOException {
         if (kid == null && names == null && sn == null) {
             throw new IllegalArgumentException(
                     "AuthorityKeyIdentifierExtension cannot be empty");
@@ -205,10 +199,9 @@ public class AuthorityKeyIdentifierExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             extensionId = PKIXExtensions.AuthorityKey_Id;
             critical = false;

src/java.base/share/classes/sun/security/x509/BasicConstraintsExtension.java

@@ -56,7 +56,7 @@ public class BasicConstraintsExtension extends Extension {
     private int pathLen = -1;
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         DerOutputStream out = new DerOutputStream();
         DerOutputStream tmp = new DerOutputStream();
 
@@ -78,7 +78,7 @@ public class BasicConstraintsExtension extends Extension {
      * @param ca true, if the subject of the Certificate is a CA.
      * @param len specifies the depth of the certification path.
      */
-    public BasicConstraintsExtension(boolean ca, int len) throws IOException {
+    public BasicConstraintsExtension(boolean ca, int len) {
         this(Boolean.valueOf(ca), ca, len);
     }
 
@@ -89,8 +89,7 @@ public class BasicConstraintsExtension extends Extension {
      * @param ca true, if the subject of the Certificate is a CA.
      * @param len specifies the depth of the certification path.
      */
-    public BasicConstraintsExtension(Boolean critical, boolean ca, int len)
+    public BasicConstraintsExtension(Boolean critical, boolean ca, int len) {
-    throws IOException {
         this.ca = ca;
         this.pathLen = len;
         this.extensionId = PKIXExtensions.BasicConstraints_Id;
@@ -178,7 +177,7 @@ public class BasicConstraintsExtension extends Extension {
       * @param out the DerOutputStream to encode the extension to.
       */
      @Override
-     public void encode(DerOutputStream out) throws IOException {
+     public void encode(DerOutputStream out) {
          if (extensionValue == null) {
              this.extensionId = PKIXExtensions.BasicConstraints_Id;
              critical = ca;

src/java.base/share/classes/sun/security/x509/CRLDistributionPointsExtension.java

@@ -93,10 +93,9 @@ public class CRLDistributionPointsExtension extends Extension {
      * DistributionPoint; the criticality is set to false.
      *
      * @param distributionPoints the list of distribution points
-     * @throws IOException on error
      */
     public CRLDistributionPointsExtension(
-        List<DistributionPoint> distributionPoints) throws IOException {
+            List<DistributionPoint> distributionPoints) {
 
         this(false, distributionPoints);
     }
@@ -108,10 +107,9 @@ public class CRLDistributionPointsExtension extends Extension {
      * @param isCritical the criticality setting.
      * @param distributionPoints the list of distribution points,
      *                           cannot be null or empty.
-     * @throws IOException on error
      */
     public CRLDistributionPointsExtension(boolean isCritical,
-        List<DistributionPoint> distributionPoints) throws IOException {
+        List<DistributionPoint> distributionPoints) {
 
         this(PKIXExtensions.CRLDistributionPoints_Id, isCritical,
             distributionPoints, NAME);
@@ -122,7 +120,7 @@ public class CRLDistributionPointsExtension extends Extension {
      */
     protected CRLDistributionPointsExtension(ObjectIdentifier extensionId,
             boolean isCritical, List<DistributionPoint> distributionPoints,
-            String extensionName) throws IOException {
+            String extensionName) {
 
         if (distributionPoints == null || distributionPoints.isEmpty()) {
             throw new IllegalArgumentException(
@@ -189,10 +187,9 @@ public class CRLDistributionPointsExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         encode(out, PKIXExtensions.CRLDistributionPoints_Id, false);
     }
 
@@ -201,7 +198,7 @@ public class CRLDistributionPointsExtension extends Extension {
      * (Also called by the subclass)
      */
     protected void encode(DerOutputStream out, ObjectIdentifier extensionId,
-            boolean isCritical) throws IOException {
+            boolean isCritical) {
 
         if (this.extensionValue == null) {
             this.extensionId = extensionId;
@@ -221,7 +218,7 @@ public class CRLDistributionPointsExtension extends Extension {
 
 
      // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (distributionPoints.isEmpty()) {
             this.extensionValue = null;
         } else {

src/java.base/share/classes/sun/security/x509/CRLExtensions.java

@@ -137,30 +137,24 @@ public class CRLExtensions {
      * @param out the DerOutputStream to marshal the contents to.
      * @param isExplicit the tag indicating whether this is an entry
      * extension (false) or a CRL extension (true).
-     * @exception CRLException on encoding errors.
      */
-    public void encode(OutputStream out, boolean isExplicit)
+    public void encode(DerOutputStream out, boolean isExplicit) {
-    throws CRLException {
+        DerOutputStream extOut = new DerOutputStream();
-        try {
+        for (Extension ext : map.values()) {
-            DerOutputStream extOut = new DerOutputStream();
+            ext.encode(extOut);
-            for (Extension ext : map.values()) {
-                ext.encode(extOut);
-            }
-
-            DerOutputStream seq = new DerOutputStream();
-            seq.write(DerValue.tag_Sequence, extOut);
-
-            DerOutputStream tmp = new DerOutputStream();
-            if (isExplicit)
-                tmp.write(DerValue.createTag(DerValue.TAG_CONTEXT,
-                                             true, (byte)0), seq);
-            else
-                tmp = seq;
-
-            out.write(tmp.toByteArray());
-        } catch (IOException e) {
-            throw new CRLException("Encoding error: " + e.toString());
         }
+
+        DerOutputStream seq = new DerOutputStream();
+        seq.write(DerValue.tag_Sequence, extOut);
+
+        DerOutputStream tmp = new DerOutputStream();
+        if (isExplicit)
+            tmp.write(DerValue.createTag(DerValue.TAG_CONTEXT,
+                    true, (byte) 0), seq);
+        else
+            tmp = seq;
+
+        out.writeBytes(tmp.toByteArray());
     }
 
     /**

src/java.base/share/classes/sun/security/x509/CRLNumberExtension.java

@@ -53,7 +53,7 @@ public class CRLNumberExtension extends Extension {
     private final String extensionLabel;
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (crlNumber == null) {
             this.extensionValue = null;
             return;
@@ -69,7 +69,7 @@ public class CRLNumberExtension extends Extension {
      *
      * @param crlNum the value to be set for the extension.
      */
-    public CRLNumberExtension(int crlNum) throws IOException {
+    public CRLNumberExtension(int crlNum) {
         this(PKIXExtensions.CRLNumber_Id, false, BigInteger.valueOf(crlNum),
         NAME, LABEL);
     }
@@ -80,7 +80,7 @@ public class CRLNumberExtension extends Extension {
      *
      * @param crlNum the value to be set for the extension, cannot be null
      */
-    public CRLNumberExtension(BigInteger crlNum) throws IOException {
+    public CRLNumberExtension(BigInteger crlNum) {
         this(PKIXExtensions.CRLNumber_Id, false, crlNum, NAME, LABEL);
     }
 
@@ -88,8 +88,8 @@ public class CRLNumberExtension extends Extension {
      * Creates the extension (also called by the subclass).
      */
     protected CRLNumberExtension(ObjectIdentifier extensionId,
-        boolean isCritical, BigInteger crlNum, String extensionName,
+            boolean isCritical, BigInteger crlNum, String extensionName,
-        String extensionLabel) throws IOException {
+            String extensionLabel) {
 
         if (crlNum == null) {
             throw new IllegalArgumentException("CRL number cannot be null");
@@ -158,10 +158,9 @@ public class CRLNumberExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         encode(out, PKIXExtensions.CRLNumber_Id, true);
     }
 
@@ -170,7 +169,7 @@ public class CRLNumberExtension extends Extension {
      * (Also called by the subclass)
      */
     protected void encode(DerOutputStream out, ObjectIdentifier extensionId,
-            boolean isCritical) throws IOException {
+            boolean isCritical) {
 
        if (this.extensionValue == null) {
            this.extensionId = extensionId;

src/java.base/share/classes/sun/security/x509/CRLReasonCodeExtension.java

@@ -45,7 +45,7 @@ public class CRLReasonCodeExtension extends Extension {
 
     private int reasonCode;
 
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (reasonCode == 0) {
             this.extensionValue = null;
             return;
@@ -71,8 +71,7 @@ public class CRLReasonCodeExtension extends Extension {
      * @param critical true if the extension is to be treated as critical.
      * @param reason the enumerated value for the reason code, must be positive.
      */
-    public CRLReasonCodeExtension(boolean critical, int reason)
+    public CRLReasonCodeExtension(boolean critical, int reason) {
-            throws IOException {
         if (reason <= 0) {
             throw new IllegalArgumentException("reason code must be positive");
         }
@@ -110,10 +109,9 @@ public class CRLReasonCodeExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = PKIXExtensions.ReasonCode_Id;
             this.critical = false;

src/java.base/share/classes/sun/security/x509/CertificateAlgorithmId.java

@@ -85,10 +85,9 @@ public class CertificateAlgorithmId implements DerEncoder {
      * Encode the algorithm identifier in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         algId.encode(out);
     }
 

src/java.base/share/classes/sun/security/x509/CertificateExtensions.java

@@ -137,11 +137,9 @@ public class CertificateExtensions implements DerEncoder {
      * the context specific tag as needed in the X.509 v3 certificate.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception CertificateException on encoding errors.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         encode(out, false);
     }
 
@@ -150,11 +148,8 @@ public class CertificateExtensions implements DerEncoder {
      *
      * @param out the DerOutputStream to marshal the contents to.
      * @param isCertReq if true then no context specific tag is added.
-     * @exception CertificateException on encoding errors.
-     * @exception IOException on errors.
      */
-    public void encode(DerOutputStream out, boolean isCertReq)
+    public void encode(DerOutputStream out, boolean isCertReq) {
-            throws IOException {
         DerOutputStream extOut = new DerOutputStream();
         for (Extension ext : map.values()) {
             ext.encode(extOut);

src/java.base/share/classes/sun/security/x509/CertificateIssuerExtension.java

@@ -66,7 +66,7 @@ public class CertificateIssuerExtension extends Extension {
     /**
      * Encode this extension
      */
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (names == null || names.isEmpty()) {
             this.extensionValue = null;
             return;
@@ -81,9 +81,8 @@ public class CertificateIssuerExtension extends Extension {
      * Criticality is automatically set to true.
      *
      * @param issuer the certificate issuer, cannot be null or empty.
-     * @throws IOException on error
      */
-    public CertificateIssuerExtension(GeneralNames issuer) throws IOException {
+    public CertificateIssuerExtension(GeneralNames issuer) {
         if (issuer == null || issuer.isEmpty()) {
             throw new IllegalArgumentException("issuer cannot be null or empty");
         }
@@ -128,10 +127,9 @@ public class CertificateIssuerExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to
-     * @exception IOException on encoding errors
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             extensionId = PKIXExtensions.CertificateIssuer_Id;
             critical = true;

src/java.base/share/classes/sun/security/x509/CertificatePoliciesExtension.java

@@ -74,7 +74,7 @@ public class CertificatePoliciesExtension extends Extension {
     private List<PolicyInformation> certPolicies;
 
     // Encode this extension value.
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (certPolicies == null || certPolicies.isEmpty()) {
             this.extensionValue = null;
         } else {
@@ -96,8 +96,7 @@ public class CertificatePoliciesExtension extends Extension {
      *
      * @param certPolicies the List of PolicyInformation.
      */
-    public CertificatePoliciesExtension(List<PolicyInformation> certPolicies)
+    public CertificatePoliciesExtension(List<PolicyInformation> certPolicies) {
-    throws IOException {
         this(Boolean.FALSE, certPolicies);
     }
 
@@ -109,7 +108,7 @@ public class CertificatePoliciesExtension extends Extension {
      * @param certPolicies the List of PolicyInformation, cannot be null or empty.
      */
     public CertificatePoliciesExtension(Boolean critical,
-            List<PolicyInformation> certPolicies) throws IOException {
+            List<PolicyInformation> certPolicies) {
         if (certPolicies == null || certPolicies.isEmpty()) {
             throw new IllegalArgumentException(
                     "certificate policies cannot be null or empty");
@@ -168,10 +167,9 @@ public class CertificatePoliciesExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
           extensionId = PKIXExtensions.CertificatePolicies_Id;
           critical = false;

src/java.base/share/classes/sun/security/x509/CertificatePolicyId.java

@@ -37,7 +37,7 @@ import sun.security.util.*;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public class CertificatePolicyId {
+public class CertificatePolicyId implements DerEncoder {
     private final ObjectIdentifier id;
 
     /**
@@ -79,9 +79,9 @@ public class CertificatePolicyId {
      * Write the CertificatePolicyId to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the object to.
-     * @exception IOException on errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putOID(id);
     }
 

src/java.base/share/classes/sun/security/x509/CertificatePolicyMap.java

@@ -36,7 +36,7 @@ import sun.security.util.*;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public class CertificatePolicyMap {
+public class CertificatePolicyMap implements DerEncoder {
     private final CertificatePolicyId issuerDomain;
     private final CertificatePolicyId subjectDomain;
 
@@ -94,9 +94,9 @@ public class CertificatePolicyMap {
      * Write the CertificatePolicyMap to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the object to.
-     * @exception IOException on errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tmp = new DerOutputStream();
 
         issuerDomain.encode(tmp);

src/java.base/share/classes/sun/security/x509/CertificatePolicySet.java

@@ -38,7 +38,7 @@ import sun.security.util.*;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public class CertificatePolicySet {
+public class CertificatePolicySet implements DerEncoder {
 
     private final Vector<CertificatePolicyId> ids;
 
@@ -82,7 +82,8 @@ public class CertificatePolicySet {
      *
      * @param out the DerOutputStream to encode the data to.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tmp = new DerOutputStream();
 
         for (int i = 0; i < ids.size(); i++) {

src/java.base/share/classes/sun/security/x509/CertificateSerialNumber.java

@@ -104,10 +104,9 @@ public class CertificateSerialNumber implements DerEncoder {
      * Encode the serial number in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         serial.encode(out);
     }
 

src/java.base/share/classes/sun/security/x509/CertificateSubjectName.java

@@ -91,10 +91,9 @@ public class CertificateSubjectName implements DerEncoder {
      * Encode the name in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         dnName.encode(out);
     }
 }

src/java.base/share/classes/sun/security/x509/CertificateValidity.java

@@ -123,10 +123,9 @@ public class CertificateValidity implements DerEncoder {
      * Encode the CertificateValidity period in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
 
         DerOutputStream pair = new DerOutputStream();
 

src/java.base/share/classes/sun/security/x509/CertificateVersion.java

@@ -146,10 +146,9 @@ public class CertificateVersion implements DerEncoder {
      * Encode the CertificateVersion period in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         // Nothing for default
         if (version == V1) {
             return;

src/java.base/share/classes/sun/security/x509/CertificateX509Key.java

@@ -88,11 +88,10 @@ public class CertificateX509Key implements DerEncoder {
      * Encode the key in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
-        out.write(key.getEncoded());
+        out.writeBytes(key.getEncoded());
     }
 
    /**

src/java.base/share/classes/sun/security/x509/DNSName.java

@@ -150,9 +150,9 @@ public class DNSName implements GeneralNameInterface {
      * Encode the DNSName into the DerOutputStream.
      *
      * @param out the DER stream to encode the DNSName to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putIA5String(name);
     }
 

src/java.base/share/classes/sun/security/x509/DeltaCRLIndicatorExtension.java

@@ -69,7 +69,7 @@ public class DeltaCRLIndicatorExtension extends CRLNumberExtension {
      *
      * @param crlNum the value to be set for the extension.
      */
-    public DeltaCRLIndicatorExtension(int crlNum) throws IOException {
+    public DeltaCRLIndicatorExtension(int crlNum) {
         super(PKIXExtensions.DeltaCRLIndicator_Id, true,
             BigInteger.valueOf(crlNum), NAME, LABEL);
     }
@@ -80,7 +80,7 @@ public class DeltaCRLIndicatorExtension extends CRLNumberExtension {
      *
      * @param crlNum the value to be set for the extension.
      */
-    public DeltaCRLIndicatorExtension(BigInteger crlNum) throws IOException {
+    public DeltaCRLIndicatorExtension(BigInteger crlNum) {
         super(PKIXExtensions.DeltaCRLIndicator_Id, true, crlNum, NAME, LABEL);
     }
 
@@ -102,10 +102,9 @@ public class DeltaCRLIndicatorExtension extends CRLNumberExtension {
      * Writes the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         super.encode(out, PKIXExtensions.DeltaCRLIndicator_Id, true);
     }
 }

src/java.base/share/classes/sun/security/x509/DistributionPoint.java

@@ -29,6 +29,7 @@ import java.io.IOException;
 import java.util.*;
 
 import sun.security.util.BitArray;
+import sun.security.util.DerEncoder;
 import sun.security.util.DerOutputStream;
 import sun.security.util.DerValue;
 
@@ -93,7 +94,7 @@ import sun.security.util.DerValue;
  * @since 1.4.2
  * @see CRLDistributionPointsExtension
  */
-public class DistributionPoint {
+public class DistributionPoint implements DerEncoder {
 
     // reason flag bits
     // NOTE that these are NOT quite the same as the CRL reason code extension
@@ -275,9 +276,9 @@ public class DistributionPoint {
      * Write the DistributionPoint value to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on error.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tagged = new DerOutputStream();
 
         // NOTE: only one of pointNames and pointRDN can be set

src/java.base/share/classes/sun/security/x509/DistributionPointName.java

@@ -28,6 +28,7 @@ package sun.security.x509;
 import java.io.IOException;
 import java.util.Objects;
 
+import sun.security.util.DerEncoder;
 import sun.security.util.DerOutputStream;
 import sun.security.util.DerValue;
 
@@ -78,7 +79,7 @@ import sun.security.util.DerValue;
  * @see IssuingDistributionPointExtension
  * @since 1.6
  */
-public class DistributionPointName {
+public class DistributionPointName implements DerEncoder {
 
     // ASN.1 context specific tag values
     private static final byte TAG_FULL_NAME = 0;
@@ -164,9 +165,9 @@ public class DistributionPointName {
      * Encodes the distribution point name and writes it to the DerOutputStream.
      *
      * @param out the output stream.
-     * @exception IOException on encoding error.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
 
         DerOutputStream theChoice = new DerOutputStream();
 

src/java.base/share/classes/sun/security/x509/EDIPartyName.java

@@ -124,9 +124,9 @@ public class EDIPartyName implements GeneralNameInterface {
      * Encode the EDI party name into the DerOutputStream.
      *
      * @param out the DER stream to encode the EDIPartyName to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tagged = new DerOutputStream();
         DerOutputStream tmp = new DerOutputStream();
 

src/java.base/share/classes/sun/security/x509/ExtendedKeyUsageExtension.java

@@ -86,7 +86,7 @@ public class ExtendedKeyUsageExtension extends Extension {
     private Vector<ObjectIdentifier> keyUsages;
 
     // Encode this extension value.
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (keyUsages == null || keyUsages.isEmpty()) {
             this.extensionValue = null;
             return;
@@ -108,8 +108,7 @@ public class ExtendedKeyUsageExtension extends Extension {
      *
      * @param keyUsages the Vector of KeyUsages (ObjectIdentifiers)
      */
-    public ExtendedKeyUsageExtension(Vector<ObjectIdentifier> keyUsages)
+    public ExtendedKeyUsageExtension(Vector<ObjectIdentifier> keyUsages) {
-    throws IOException {
         this(Boolean.FALSE, keyUsages);
     }
 
@@ -121,8 +120,7 @@ public class ExtendedKeyUsageExtension extends Extension {
      * @param keyUsages the Vector of KeyUsages (ObjectIdentifiers),
      *                  cannot be null or empty.
      */
-    public ExtendedKeyUsageExtension(Boolean critical, Vector<ObjectIdentifier> keyUsages)
+    public ExtendedKeyUsageExtension(Boolean critical, Vector<ObjectIdentifier> keyUsages) {
-            throws IOException {
         if (keyUsages == null || keyUsages.isEmpty()) {
             throw new IllegalArgumentException(
                     "key usages cannot be null or empty");
@@ -188,10 +186,9 @@ public class ExtendedKeyUsageExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
           extensionId = PKIXExtensions.ExtendedKeyUsage_Id;
           critical = false;

src/java.base/share/classes/sun/security/x509/Extension.java

@@ -169,10 +169,9 @@ public class Extension implements java.security.cert.Extension, DerEncoder {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
 
         Objects.requireNonNull(extensionId,
                 "No OID to encode for the extension");

src/java.base/share/classes/sun/security/x509/FreshestCRLExtension.java

@@ -65,8 +65,7 @@ public class FreshestCRLExtension extends CRLDistributionPointsExtension {
      *
      * @param distributionPoints the list of delta CRL distribution points.
      */
-    public FreshestCRLExtension(List<DistributionPoint> distributionPoints)
+    public FreshestCRLExtension(List<DistributionPoint> distributionPoints) {
-        throws IOException {
 
         super(PKIXExtensions.FreshestCRL_Id, false, distributionPoints, NAME);
     }
@@ -88,10 +87,9 @@ public class FreshestCRLExtension extends CRLDistributionPointsExtension {
      * Writes the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         super.encode(out, PKIXExtensions.FreshestCRL_Id, false);
     }
 }

src/java.base/share/classes/sun/security/x509/GeneralName.java

@@ -49,7 +49,7 @@ import sun.security.util.*;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public class GeneralName {
+public class GeneralName implements DerEncoder {
 
     // Private data members
     private final GeneralNameInterface name;
@@ -231,9 +231,9 @@ public class GeneralName {
      * Encode the name to the specified DerOutputStream.
      *
      * @param out the DerOutputStream to encode the GeneralName to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tmp = new DerOutputStream();
         name.encode(tmp);
         int nameType = name.getType();

src/java.base/share/classes/sun/security/x509/GeneralNameInterface.java

@@ -25,8 +25,6 @@
 
 package sun.security.x509;
 
-import java.io.IOException;
-
 import sun.security.util.*;
 
 /**
@@ -36,7 +34,7 @@ import sun.security.util.*;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public interface GeneralNameInterface {
+public interface GeneralNameInterface extends DerEncoder {
     /**
      * The list of names supported.
      */
@@ -65,15 +63,6 @@ public interface GeneralNameInterface {
      */
     int getType();
 
-    /**
-     * Encode the name to the specified DerOutputStream.
-     *
-     * @param out the DerOutputStream to encode the GeneralName to.
-     * @exception IOException thrown if the GeneralName could not be
-     *            encoded.
-     */
-    void encode(DerOutputStream out) throws IOException;
-
     /**
      * Return type of constraint inputName places on this name:<ul>
      *   <li>NAME_DIFF_TYPE = -1: input name is different type from name (i.e. does not constrain).

src/java.base/share/classes/sun/security/x509/GeneralNames.java

@@ -109,9 +109,8 @@ public class GeneralNames {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on error.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (isEmpty()) {
             return;
         }

src/java.base/share/classes/sun/security/x509/GeneralSubtree.java

@@ -43,7 +43,7 @@ import sun.security.util.*;
  * @author Amit Kapoor
  * @author Hemma Prafullchandra
  */
-public class GeneralSubtree {
+public class GeneralSubtree implements DerEncoder {
     private static final byte TAG_MIN = 0;
     private static final byte TAG_MAX = 1;
     private static final int  MIN_DEFAULT = 0;
@@ -194,7 +194,8 @@ public class GeneralSubtree {
      *
      * @param out the DerOutputStream to encode this object to.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream seq = new DerOutputStream();
 
         name.encode(seq);

src/java.base/share/classes/sun/security/x509/GeneralSubtrees.java

@@ -43,7 +43,7 @@ import sun.security.util.*;
  * @author Hemma Prafullchandra
  * @author Andreas Sterbenz
  */
-public class GeneralSubtrees implements Cloneable {
+public class GeneralSubtrees implements Cloneable, DerEncoder {
 
     private final List<GeneralSubtree> trees;
 
@@ -132,7 +132,8 @@ public class GeneralSubtrees implements Cloneable {
      *
      * @param out the DerOutputStream to encode this object to.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream seq = new DerOutputStream();
 
         for (int i = 0, n = size(); i < n; i++) {

src/java.base/share/classes/sun/security/x509/IPAddressName.java

@@ -226,9 +226,9 @@ public class IPAddressName implements GeneralNameInterface {
      * Encode the IPAddress name into the DerOutputStream.
      *
      * @param out the DER stream to encode the IPAddressName to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putOctetString(address);
     }
 

src/java.base/share/classes/sun/security/x509/InhibitAnyPolicyExtension.java

@@ -69,7 +69,7 @@ public class InhibitAnyPolicyExtension extends Extension {
     private int skipCerts = Integer.MAX_VALUE;
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         DerOutputStream out = new DerOutputStream();
         out.putInteger(skipCerts);
         this.extensionValue = out.toByteArray();
@@ -81,7 +81,7 @@ public class InhibitAnyPolicyExtension extends Extension {
      * @param skipCerts specifies the depth of the certification path.
      *                  Use value of -1 to request unlimited depth.
      */
-    public InhibitAnyPolicyExtension(int skipCerts) throws IOException {
+    public InhibitAnyPolicyExtension(int skipCerts) {
         if (skipCerts < -1)
             throw new IllegalArgumentException("Invalid value for skipCerts");
         if (skipCerts == -1)
@@ -144,7 +144,7 @@ public class InhibitAnyPolicyExtension extends Extension {
      * @param out the DerOutputStream to encode the extension to.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             this.extensionId = PKIXExtensions.InhibitAnyPolicy_Id;
             critical = true;

src/java.base/share/classes/sun/security/x509/InvalidityDateExtension.java

@@ -64,7 +64,7 @@ public class InvalidityDateExtension extends Extension {
 
     private Date date;
 
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (date == null) {
             this.extensionValue = null;
             return;
@@ -80,7 +80,7 @@ public class InvalidityDateExtension extends Extension {
      *
      * @param date the invalidity date
      */
-    public InvalidityDateExtension(Date date) throws IOException {
+    public InvalidityDateExtension(Date date) {
         this(false, date);
     }
 
@@ -90,8 +90,7 @@ public class InvalidityDateExtension extends Extension {
      * @param critical true if the extension is to be treated as critical.
      * @param date the invalidity date, cannot be null.
      */
-    public InvalidityDateExtension(boolean critical, Date date)
+    public InvalidityDateExtension(boolean critical, Date date) {
-            throws IOException {
         if (date == null) {
             throw new IllegalArgumentException("date cannot be null");
         }
@@ -141,10 +140,9 @@ public class InvalidityDateExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to
-     * @exception IOException on encoding errors
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = PKIXExtensions.InvalidityDate_Id;
             this.critical = false;

src/java.base/share/classes/sun/security/x509/IssuerAlternativeNameExtension.java

@@ -52,7 +52,7 @@ public class IssuerAlternativeNameExtension extends Extension {
     GeneralNames names;
 
     // Encode this extension
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (names == null || names.isEmpty()) {
             this.extensionValue = null;
             return;
@@ -66,10 +66,8 @@ public class IssuerAlternativeNameExtension extends Extension {
      * Create a IssuerAlternativeNameExtension with the passed GeneralNames.
      *
      * @param names the GeneralNames for the issuer.
-     * @exception IOException on error.
      */
-    public IssuerAlternativeNameExtension(GeneralNames names)
+    public IssuerAlternativeNameExtension(GeneralNames names) {
-            throws IOException {
         this(false, names);
     }
 
@@ -79,10 +77,8 @@ public class IssuerAlternativeNameExtension extends Extension {
      *
      * @param critical true if the extension is to be treated as critical.
      * @param names the GeneralNames for the issuer, cannot be null or empty.
-     * @exception IOException on error.
      */
-    public IssuerAlternativeNameExtension(Boolean critical, GeneralNames names)
+    public IssuerAlternativeNameExtension(Boolean critical, GeneralNames names) {
-            throws IOException {
         if (names == null || names.isEmpty()) {
             throw new IllegalArgumentException("names cannot be null or empty");
         }
@@ -138,10 +134,9 @@ public class IssuerAlternativeNameExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             extensionId = PKIXExtensions.IssuerAlternativeName_Id;
             critical = false;

src/java.base/share/classes/sun/security/x509/IssuingDistributionPointExtension.java

@@ -112,13 +112,11 @@ public class IssuingDistributionPointExtension extends Extension {
      *        <code>hasOnlyUserCerts</code>, <code>hasOnlyCACerts</code>,
      *        <code>hasOnlyAttributeCerts</code> is set to <code>true</code>,
      *        or all arguments are either <code>null</code> or <code>false</code>.
-     * @throws IOException on encoding error.
      */
     public IssuingDistributionPointExtension(
         DistributionPointName distributionPoint, ReasonFlags revocationReasons,
         boolean hasOnlyUserCerts, boolean hasOnlyCACerts,
-        boolean hasOnlyAttributeCerts, boolean isIndirectCRL)
+        boolean hasOnlyAttributeCerts, boolean isIndirectCRL) {
-            throws IOException {
 
         if (distributionPoint == null &&
                 revocationReasons == null &&
@@ -222,10 +220,9 @@ public class IssuingDistributionPointExtension extends Extension {
      * DerOutputStream.
      *
      * @param out the output stream.
-     * @exception IOException on encoding error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
             this.critical = false;
@@ -264,7 +261,7 @@ public class IssuingDistributionPointExtension extends Extension {
     }
 
      // Encodes this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
 
         if (distributionPoint == null &&
             revocationReasons == null &&

src/java.base/share/classes/sun/security/x509/KeyIdentifier.java

@@ -125,7 +125,7 @@ public class KeyIdentifier {
      * @param out the DerOutputStream to write the object to.
      * @exception IOException
      */
-    void encode(DerOutputStream out) throws IOException {
+    void encode(DerOutputStream out) {
         out.putOctetString(octetString);
     }
 

src/java.base/share/classes/sun/security/x509/KeyUsageExtension.java

@@ -59,7 +59,7 @@ public class KeyUsageExtension extends Extension {
     private boolean[] bitString;
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         DerOutputStream os = new DerOutputStream();
         os.putTruncatedUnalignedBitString(new BitArray(this.bitString));
         this.extensionValue = os.toByteArray();
@@ -94,7 +94,7 @@ public class KeyUsageExtension extends Extension {
      *
      * @param bitString the bits to be set for the extension.
      */
-    public KeyUsageExtension(byte[] bitString) throws IOException {
+    public KeyUsageExtension(byte[] bitString) {
         this.bitString =
             new BitArray(bitString.length*8,bitString).toBooleanArray();
         this.extensionId = PKIXExtensions.KeyUsage_Id;
@@ -108,7 +108,7 @@ public class KeyUsageExtension extends Extension {
      *
      * @param bitString the bits to be set for the extension.
      */
-    public KeyUsageExtension(boolean[] bitString) throws IOException {
+    public KeyUsageExtension(boolean[] bitString) {
         this.bitString = bitString;
         this.extensionId = PKIXExtensions.KeyUsage_Id;
         this.critical = true;
@@ -121,7 +121,7 @@ public class KeyUsageExtension extends Extension {
      *
      * @param bitString the bits to be set for the extension.
      */
-    public KeyUsageExtension(BitArray bitString) throws IOException {
+    public KeyUsageExtension(BitArray bitString) {
         this.bitString = bitString.toBooleanArray();
         this.extensionId = PKIXExtensions.KeyUsage_Id;
         this.critical = true;
@@ -272,10 +272,9 @@ public class KeyUsageExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
        if (this.extensionValue == null) {
            this.extensionId = PKIXExtensions.KeyUsage_Id;
            this.critical = true;

src/java.base/share/classes/sun/security/x509/NameConstraintsExtension.java

@@ -101,7 +101,7 @@ public class NameConstraintsExtension extends Extension
     }
 
     // Encode this extension value.
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         minMaxValid = false;
         if (permitted == null && excluded == null) {
             this.extensionValue = null;
@@ -135,8 +135,7 @@ public class NameConstraintsExtension extends Extension
      * @param excluded the excluded GeneralSubtrees (null for optional).
      */
     public NameConstraintsExtension(GeneralSubtrees permitted,
-                                    GeneralSubtrees excluded)
+                                    GeneralSubtrees excluded) {
-            throws IOException {
         if (permitted == null && excluded == null) {
             throw new IllegalArgumentException(
                     "permitted and excluded cannot both be null");
@@ -226,10 +225,9 @@ public class NameConstraintsExtension extends Extension
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = PKIXExtensions.NameConstraints_Id;
             this.critical = true;

src/java.base/share/classes/sun/security/x509/NetscapeCertTypeExtension.java

@@ -26,7 +26,6 @@
 package sun.security.x509;
 
 import java.io.IOException;
-import java.util.*;
 
 import sun.security.util.*;
 
@@ -86,13 +85,6 @@ public class NetscapeCertTypeExtension extends Extension {
         new MapEntry(OBJECT_SIGNING_CA, 7),
     };
 
-    private static final Vector<String> mAttributeNames = new Vector<>();
-    static {
-        for (MapEntry entry : mMapData) {
-            mAttributeNames.add(entry.mName);
-        }
-    }
-
     private static int getPosition(String name) throws IOException {
         for (int i = 0; i < mMapData.length; i++) {
             if (name.equalsIgnoreCase(mMapData[i].mName))
@@ -103,7 +95,7 @@ public class NetscapeCertTypeExtension extends Extension {
     }
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         DerOutputStream os = new DerOutputStream();
         os.putTruncatedUnalignedBitString(new BitArray(this.bitString));
         this.extensionValue = os.toByteArray();
@@ -138,7 +130,7 @@ public class NetscapeCertTypeExtension extends Extension {
      *
      * @param bitString the bits to be set for the extension.
      */
-    public NetscapeCertTypeExtension(byte[] bitString) throws IOException {
+    public NetscapeCertTypeExtension(byte[] bitString) {
         this.bitString =
             new BitArray(bitString.length*8, bitString).toBooleanArray();
         this.extensionId = NetscapeCertType_Id;
@@ -152,7 +144,7 @@ public class NetscapeCertTypeExtension extends Extension {
      *
      * @param bitString the bits to be set for the extension.
      */
-    public NetscapeCertTypeExtension(boolean[] bitString) throws IOException {
+    public NetscapeCertTypeExtension(boolean[] bitString) {
         this.bitString = bitString;
         this.extensionId = NetscapeCertType_Id;
         this.critical = true;
@@ -238,10 +230,9 @@ public class NetscapeCertTypeExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = NetscapeCertType_Id;
             this.critical = true;

src/java.base/share/classes/sun/security/x509/OIDName.java

@@ -86,9 +86,9 @@ public class OIDName implements GeneralNameInterface {
      * Encode the OID name into the DerOutputStream.
      *
      * @param out the DER stream to encode the OIDName to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putOID(oid);
     }
 

src/java.base/share/classes/sun/security/x509/OtherName.java

@@ -151,9 +151,9 @@ public class OtherName implements GeneralNameInterface {
      * Encode the Other name into the DerOutputStream.
      *
      * @param out the DER stream to encode the Other-Name to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         if (gni != null) {
             // This OtherName has a supported class
             gni.encode(out);

src/java.base/share/classes/sun/security/x509/PolicyConstraintsExtension.java

@@ -62,7 +62,7 @@ public class PolicyConstraintsExtension extends Extension {
     private int inhibit = -1;
 
     // Encode this extension value.
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (require == -1 && inhibit == -1) {
             this.extensionValue = null;
             return;
@@ -94,8 +94,7 @@ public class PolicyConstraintsExtension extends Extension {
      * @param require require explicit policy (-1 for optional).
      * @param inhibit inhibit policy mapping (-1 for optional).
      */
-    public PolicyConstraintsExtension(int require, int inhibit)
+    public PolicyConstraintsExtension(int require, int inhibit) {
-    throws IOException {
         this(Boolean.TRUE, require, inhibit);
     }
 
@@ -108,8 +107,7 @@ public class PolicyConstraintsExtension extends Extension {
      * @param require require explicit policy (-1 for optional).
      * @param inhibit inhibit policy mapping (-1 for optional).
      */
-    public PolicyConstraintsExtension(Boolean critical, int require, int inhibit)
+    public PolicyConstraintsExtension(Boolean critical, int require, int inhibit) {
-            throws IOException {
         if (require == -1 && inhibit == -1) {
             throw new IllegalArgumentException(
                     "require and inhibit cannot both be -1");
@@ -190,10 +188,9 @@ public class PolicyConstraintsExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
           extensionId = PKIXExtensions.PolicyConstraints_Id;
           critical = true;

src/java.base/share/classes/sun/security/x509/PolicyInformation.java

@@ -32,6 +32,7 @@ import java.util.LinkedHashSet;
 import java.util.Objects;
 import java.util.Set;
 
+import sun.security.util.DerEncoder;
 import sun.security.util.DerValue;
 import sun.security.util.DerOutputStream;
 /**
@@ -59,7 +60,7 @@ import sun.security.util.DerOutputStream;
  * @author Anne Anderson
  * @since       1.4
  */
-public class PolicyInformation {
+public class PolicyInformation implements DerEncoder {
 
     // Attribute names
     public static final String NAME       = "PolicyInformation";
@@ -178,15 +179,15 @@ public class PolicyInformation {
      * Write the PolicyInformation to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tmp = new DerOutputStream();
         policyIdentifier.encode(tmp);
         if (!policyQualifiers.isEmpty()) {
             DerOutputStream tmp2 = new DerOutputStream();
             for (PolicyQualifierInfo pq : policyQualifiers) {
-                tmp2.write(pq.getEncoded());
+                tmp2.writeBytes(pq.getEncoded());
             }
             tmp.write(DerValue.tag_Sequence, tmp2);
         }

src/java.base/share/classes/sun/security/x509/PolicyMappingsExtension.java

@@ -56,7 +56,7 @@ public class PolicyMappingsExtension extends Extension {
     private List<CertificatePolicyMap> maps;
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (maps == null || maps.isEmpty()) {
             this.extensionValue = null;
             return;
@@ -77,8 +77,7 @@ public class PolicyMappingsExtension extends Extension {
      *
      * @param maps the List of CertificatePolicyMap, cannot be null or empty.
      */
-    public PolicyMappingsExtension(List<CertificatePolicyMap> maps)
+    public PolicyMappingsExtension(List<CertificatePolicyMap> maps) {
-            throws IOException {
         if (maps == null || maps.isEmpty()) {
             throw new IllegalArgumentException("maps cannot be null or empty");
         }
@@ -129,10 +128,9 @@ public class PolicyMappingsExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             extensionId = PKIXExtensions.PolicyMappings_Id;
             critical = true;

src/java.base/share/classes/sun/security/x509/PrivateKeyUsageExtension.java

@@ -68,7 +68,7 @@ public class PrivateKeyUsageExtension extends Extension {
     private Date        notAfter = null;
 
     // Encode this extension value.
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (notBefore == null && notAfter == null) {
             this.extensionValue = null;
             return;
@@ -101,8 +101,7 @@ public class PrivateKeyUsageExtension extends Extension {
      * @param notAfter the date/time after which the private key
      *         should not be used.
      */
-    public PrivateKeyUsageExtension(Date notBefore, Date notAfter)
+    public PrivateKeyUsageExtension(Date notBefore, Date notAfter) {
-            throws IOException {
         if (notBefore == null && notAfter == null) {
             throw new IllegalArgumentException(
                     "notBefore and notAfter cannot both be null");
@@ -230,10 +229,9 @@ public class PrivateKeyUsageExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             extensionId = PKIXExtensions.PrivateKeyUsage_Id;
             critical = false;

src/java.base/share/classes/sun/security/x509/RDN.java

@@ -333,9 +333,8 @@ public class RDN {
      * Encode the RDN in DER-encoded form.
      *
      * @param out DerOutputStream to which RDN is to be written
-     * @throws IOException on error
      */
-    void encode(DerOutputStream out) throws IOException {
+    void encode(DerOutputStream out) {
         out.putOrderedSetOf(DerValue.tag_Set, assertion);
     }
 

src/java.base/share/classes/sun/security/x509/RFC822Name.java

@@ -114,9 +114,9 @@ public class RFC822Name implements GeneralNameInterface
      * Encode the RFC822 name into the DerOutputStream.
      *
      * @param out the DER stream to encode the RFC822Name to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putIA5String(name);
     }
 

src/java.base/share/classes/sun/security/x509/ReasonFlags.java

@@ -27,10 +27,7 @@ package sun.security.x509;
 
 import java.io.IOException;
 
-import sun.security.util.BitArray;
+import sun.security.util.*;
-import sun.security.util.DerInputStream;
-import sun.security.util.DerOutputStream;
-import sun.security.util.DerValue;
 
 /**
  * Represent the CRL Reason Flags.
@@ -53,7 +50,7 @@ import sun.security.util.DerValue;
  *
  * @author Hemma Prafullchandra
  */
-public class ReasonFlags {
+public class ReasonFlags implements DerEncoder {
 
     /**
      * Reasons
@@ -231,9 +228,9 @@ public class ReasonFlags {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putTruncatedUnalignedBitString(new BitArray(this.bitString));
     }
 }

src/java.base/share/classes/sun/security/x509/SerialNumber.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2002, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -108,9 +108,8 @@ public class SerialNumber {
      * Encode the SerialNumber in DER form to the stream.
      *
      * @param out the DerOutputStream to marshal the contents to.
-     * @exception IOException on errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         out.putInteger(serialNum);
     }
 

src/java.base/share/classes/sun/security/x509/SubjectAlternativeNameExtension.java

@@ -57,7 +57,7 @@ public class SubjectAlternativeNameExtension extends Extension {
     GeneralNames        names;
 
     // Encode this extension
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (names == null || names.isEmpty()) {
             this.extensionValue = null;
             return;
@@ -72,10 +72,8 @@ public class SubjectAlternativeNameExtension extends Extension {
      * The extension is marked non-critical.
      *
      * @param names the GeneralNames for the subject.
-     * @exception IOException on error.
      */
-    public SubjectAlternativeNameExtension(GeneralNames names)
+    public SubjectAlternativeNameExtension(GeneralNames names) {
-    throws IOException {
         this(Boolean.FALSE, names);
     }
 
@@ -85,10 +83,8 @@ public class SubjectAlternativeNameExtension extends Extension {
      *
      * @param critical true if the extension is to be treated as critical.
      * @param names the GeneralNames for the subject, cannot be null or empty.
-     * @exception IOException on error.
      */
-    public SubjectAlternativeNameExtension(Boolean critical, GeneralNames names)
+    public SubjectAlternativeNameExtension(Boolean critical, GeneralNames names) {
-            throws IOException {
         if (names == null || names.isEmpty()) {
             throw new IllegalArgumentException("names cannot be null or empty");
         }
@@ -142,10 +138,9 @@ public class SubjectAlternativeNameExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             extensionId = PKIXExtensions.SubjectAlternativeName_Id;
             critical = false;

src/java.base/share/classes/sun/security/x509/SubjectInfoAccessExtension.java

@@ -80,10 +80,9 @@ public class SubjectInfoAccessExtension extends Extension {
      *
      * @param accessDescriptions the List of AccessDescription,
      *                           cannot be null or empty.
-     * @throws IOException on error
      */
     public SubjectInfoAccessExtension(
-            List<AccessDescription> accessDescriptions) throws IOException {
+            List<AccessDescription> accessDescriptions) {
         if (accessDescriptions == null || accessDescriptions.isEmpty()) {
             throw new IllegalArgumentException(
                     "accessDescriptions cannot be null or empty");
@@ -143,10 +142,9 @@ public class SubjectInfoAccessExtension extends Extension {
      * Write the extension to the DerOutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (this.extensionValue == null) {
             this.extensionId = PKIXExtensions.SubjectInfoAccess_Id;
             this.critical = false;
@@ -156,7 +154,7 @@ public class SubjectInfoAccessExtension extends Extension {
     }
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (accessDescriptions.isEmpty()) {
             this.extensionValue = null;
         } else {

src/java.base/share/classes/sun/security/x509/SubjectKeyIdentifierExtension.java

@@ -57,7 +57,7 @@ public class SubjectKeyIdentifierExtension extends Extension {
     private KeyIdentifier id;
 
     // Encode this extension value
-    private void encodeThis() throws IOException {
+    private void encodeThis() {
         if (id == null) {
             this.extensionValue = null;
             return;
@@ -72,8 +72,7 @@ public class SubjectKeyIdentifierExtension extends Extension {
      * The criticality is set to False.
      * @param octetString the octet string identifying the key identifier.
      */
-    public SubjectKeyIdentifierExtension(byte[] octetString)
+    public SubjectKeyIdentifierExtension(byte[] octetString) {
-            throws IOException {
         id = new KeyIdentifier(octetString);
 
         this.extensionId = PKIXExtensions.SubjectKey_Id;
@@ -110,10 +109,9 @@ public class SubjectKeyIdentifierExtension extends Extension {
      * Write the extension to the OutputStream.
      *
      * @param out the DerOutputStream to write the extension to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         if (extensionValue == null) {
             extensionId = PKIXExtensions.SubjectKey_Id;
             critical = false;

src/java.base/share/classes/sun/security/x509/URIName.java

@@ -197,9 +197,9 @@ public class URIName implements GeneralNameInterface {
      * Encode the URI name into the DerOutputStream.
      *
      * @param out the DER stream to encode the URIName to.
-     * @exception IOException on encoding errors.
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         out.putIA5String(uri.toASCIIString());
     }
 

src/java.base/share/classes/sun/security/x509/UniqueIdentity.java

@@ -92,9 +92,8 @@ public class UniqueIdentity {
      *
      * @param out the DerOutputStream to marshal the contents to.
      * @param tag encode it under the following tag.
-     * @exception IOException on errors.
      */
-    public void encode(DerOutputStream out, byte tag) throws IOException {
+    public void encode(DerOutputStream out, byte tag) {
         byte[] bytes = id.toByteArray();
         int excessBits = bytes.length*8 - id.length();
 
@@ -102,7 +101,7 @@ public class UniqueIdentity {
         out.putLength(bytes.length + 1);
 
         out.write(excessBits);
-        out.write(bytes);
+        out.writeBytes(bytes);
     }
 
     /**

src/java.base/share/classes/sun/security/x509/X400Address.java

@@ -364,10 +364,9 @@ public class X400Address implements GeneralNameInterface {
      * Encode the X400 name into the DerOutputStream.
      *
      * @param out the DER stream to encode the X400Address to.
-     * @exception IOException on encoding errors.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
         out.putDerValue(derValue);
     }
 

src/java.base/share/classes/sun/security/x509/X500Name.java

@@ -826,7 +826,8 @@ public class X500Name implements GeneralNameInterface, Principal {
      *
      * @param out where to put the DER-encoded X.500 name
      */
-    public void encode(DerOutputStream out) throws IOException {
+    @Override
+    public void encode(DerOutputStream out) {
         DerOutputStream tmp = new DerOutputStream();
         for (int i = 0; i < names.length; i++) {
             names[i].encode(tmp);

src/java.base/share/classes/sun/security/x509/X509CRLEntryImpl.java

@@ -152,47 +152,40 @@ public class X509CRLEntryImpl extends X509CRLEntry
      *
      * @param outStrm an output stream to which the encoded revoked
      * certificate is written.
-     * @exception CRLException on encoding errors.
      */
-    public void encode(DerOutputStream outStrm) throws CRLException {
+    public void encode(DerOutputStream outStrm) {
-        try {
+        if (revokedCert == null) {
-            if (revokedCert == null) {
+            DerOutputStream tmp = new DerOutputStream();
-                DerOutputStream tmp = new DerOutputStream();
+            // sequence { serialNumber, revocationDate, extensions }
-                // sequence { serialNumber, revocationDate, extensions }
+            serialNumber.encode(tmp);
-                serialNumber.encode(tmp);
 
-                if (revocationDate.getTime() < CertificateValidity.YR_2050) {
+            if (revocationDate.getTime() < CertificateValidity.YR_2050) {
-                    tmp.putUTCTime(revocationDate);
+                tmp.putUTCTime(revocationDate);
-                } else {
+            } else {
-                    tmp.putGeneralizedTime(revocationDate);
+                tmp.putGeneralizedTime(revocationDate);
-                }
-
-                if (extensions != null)
-                    extensions.encode(tmp, isExplicit);
-
-                DerOutputStream seq = new DerOutputStream();
-                seq.write(DerValue.tag_Sequence, tmp);
-
-                revokedCert = seq.toByteArray();
             }
-            outStrm.write(revokedCert);
+
-        } catch (IOException e) {
+            if (extensions != null)
-             throw new CRLException("Encoding error: " + e.toString());
+                extensions.encode(tmp, isExplicit);
+
+            DerOutputStream seq = new DerOutputStream();
+            seq.write(DerValue.tag_Sequence, tmp);
+
+            revokedCert = seq.toByteArray();
         }
+        outStrm.writeBytes(revokedCert);
     }
 
     /**
      * Returns the ASN.1 DER-encoded form of this CRL Entry,
      * which corresponds to the inner SEQUENCE.
-     *
-     * @exception CRLException if an encoding error occurs.
      */
-    public byte[] getEncoded() throws CRLException {
+    public byte[] getEncoded() {
         return getEncoded0().clone();
     }
 
     // Called internally to avoid clone
-    private byte[] getEncoded0() throws CRLException {
+    private byte[] getEncoded0() {
         if (revokedCert == null)
             this.encode(new DerOutputStream());
         return revokedCert;
@@ -523,17 +516,13 @@ public class X509CRLEntryImpl extends X509CRLEntry
         if (compSerial != 0) {
             return compSerial;
         }
-        try {
+        byte[] thisEncoded = this.getEncoded0();
-            byte[] thisEncoded = this.getEncoded0();
+        byte[] thatEncoded = that.getEncoded0();
-            byte[] thatEncoded = that.getEncoded0();
+        for (int i=0; i<thisEncoded.length && i<thatEncoded.length; i++) {
-            for (int i=0; i<thisEncoded.length && i<thatEncoded.length; i++) {
+            int a = thisEncoded[i] & 0xff;
-                int a = thisEncoded[i] & 0xff;
+            int b = thatEncoded[i] & 0xff;
-                int b = thatEncoded[i] & 0xff;
+            if (a != b) return a-b;
-                if (a != b) return a-b;
-            }
-            return thisEncoded.length -thatEncoded.length;
-        } catch (CRLException ce) {
-            return -1;
         }
+        return thisEncoded.length -thatEncoded.length;
     }
 }

src/java.base/share/classes/sun/security/x509/X509CRLImpl.java

@@ -298,48 +298,43 @@ public class X509CRLImpl extends X509CRL implements DerEncoder {
          * @exception CRLException on encoding errors.
          */
         public byte[] encodeInfo() throws CRLException {
-            try {
+            DerOutputStream tmp = new DerOutputStream();
-                DerOutputStream tmp = new DerOutputStream();
+            DerOutputStream rCerts = new DerOutputStream();
-                DerOutputStream rCerts = new DerOutputStream();
+            DerOutputStream seq = new DerOutputStream();
-                DerOutputStream seq = new DerOutputStream();
 
-                if (version != 0) // v2 crl encode version
+            if (version != 0) // v2 crl encode version
-                    tmp.putInteger(version);
+                tmp.putInteger(version);
-                infoSigAlgId.encode(tmp);
+            infoSigAlgId.encode(tmp);
-                if ((version == 0) && (issuer.toString() == null))
+            if ((version == 0) && (issuer.toString() == null))
-                    throw new CRLException("Null Issuer DN not allowed in v1 CRL");
+                throw new CRLException("Null Issuer DN not allowed in v1 CRL");
-                issuer.encode(tmp);
+            issuer.encode(tmp);
 
-                if (thisUpdate.getTime() < CertificateValidity.YR_2050)
+            if (thisUpdate.getTime() < CertificateValidity.YR_2050)
-                    tmp.putUTCTime(thisUpdate);
+                tmp.putUTCTime(thisUpdate);
+            else
+                tmp.putGeneralizedTime(thisUpdate);
+
+            if (nextUpdate != null) {
+                if (nextUpdate.getTime() < CertificateValidity.YR_2050)
+                    tmp.putUTCTime(nextUpdate);
                 else
-                    tmp.putGeneralizedTime(thisUpdate);
+                    tmp.putGeneralizedTime(nextUpdate);
-
-                if (nextUpdate != null) {
-                    if (nextUpdate.getTime() < CertificateValidity.YR_2050)
-                        tmp.putUTCTime(nextUpdate);
-                    else
-                        tmp.putGeneralizedTime(nextUpdate);
-                }
-
-                if (!revokedList.isEmpty()) {
-                    for (X509CRLEntry entry : revokedList) {
-                        ((X509CRLEntryImpl)entry).encode(rCerts);
-                    }
-                    tmp.write(DerValue.tag_Sequence, rCerts);
-                }
-
-                if (extensions != null)
-                    extensions.encode(tmp, isExplicit);
-
-                seq.write(DerValue.tag_Sequence, tmp);
-
-                return seq.toByteArray();
-            } catch (IOException e) {
-                throw new CRLException("Encoding error: " + e.getMessage());
             }
-        }
 
+            if (!revokedList.isEmpty()) {
+                for (X509CRLEntry entry : revokedList) {
+                    ((X509CRLEntryImpl) entry).encode(rCerts);
+                }
+                tmp.write(DerValue.tag_Sequence, rCerts);
+            }
+
+            if (extensions != null)
+                extensions.encode(tmp, isExplicit);
+
+            seq.write(DerValue.tag_Sequence, tmp);
+
+            return seq.toByteArray();
+        }
     }
 
     private static final boolean isExplicit = true;
@@ -605,36 +600,31 @@ public class X509CRLImpl extends X509CRL implements DerEncoder {
     public static X509CRLImpl newSigned(TBSCertList info, PrivateKey key, String algorithm, String provider)
             throws CRLException, NoSuchAlgorithmException, InvalidKeyException,
                    NoSuchProviderException, SignatureException {
-        try {
+        Signature sigEngine = SignatureUtil.fromKey(algorithm, key, provider);
-            Signature sigEngine = SignatureUtil.fromKey(algorithm, key, provider);
+        AlgorithmId sigAlgId = SignatureUtil.fromSignature(sigEngine, key);
-            AlgorithmId sigAlgId = SignatureUtil.fromSignature(sigEngine, key);
+        info.infoSigAlgId = sigAlgId;
-            info.infoSigAlgId = sigAlgId;
 
-            DerOutputStream out = new DerOutputStream();
+        DerOutputStream out = new DerOutputStream();
-            DerOutputStream tmp = new DerOutputStream();
+        DerOutputStream tmp = new DerOutputStream();
 
-            // encode crl info
+        // encode crl info
-            byte[] tbsCertList = info.encodeInfo();
+        byte[] tbsCertList = info.encodeInfo();
-            tmp.writeBytes(tbsCertList);
+        tmp.writeBytes(tbsCertList);
 
-            // encode algorithm identifier
+        // encode algorithm identifier
-            sigAlgId.encode(tmp);
+        sigAlgId.encode(tmp);
 
-            // Create and encode the signature itself.
+        // Create and encode the signature itself.
-            sigEngine.update(tbsCertList, 0, tbsCertList.length);
+        sigEngine.update(tbsCertList, 0, tbsCertList.length);
-            byte[] signature = sigEngine.sign();
+        byte[] signature = sigEngine.sign();
-            tmp.putBitString(signature);
+        tmp.putBitString(signature);
 
-            // Wrap the signed data in a SEQUENCE { data, algorithm, sig }
+        // Wrap the signed data in a SEQUENCE { data, algorithm, sig }
-            out.write(DerValue.tag_Sequence, tmp);
+        out.write(DerValue.tag_Sequence, tmp);
-            byte[] signedCRL = out.toByteArray();
+        byte[] signedCRL = out.toByteArray();
 
-            return new X509CRLImpl(info, sigAlgId, signature,
+        return new X509CRLImpl(info, sigAlgId, signature,
-                    tbsCertList, signedCRL);
+                tbsCertList, signedCRL);
-        } catch (IOException e) {
-            throw new CRLException("Error while encoding data: " +
-                                   e.getMessage());
-        }
     }
 
     /**
@@ -1251,8 +1241,8 @@ public class X509CRLImpl extends X509CRL implements DerEncoder {
     }
 
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
-        out.write(signedCRL.clone());
+        out.writeBytes(signedCRL);
     }
 
     /**

src/java.base/share/classes/sun/security/x509/X509CertImpl.java

@@ -260,12 +260,10 @@ public class X509CertImpl extends X509Certificate implements DerEncoder {
      * Implements the <code>DerEncoder</code> interface.
      *
      * @param out the output stream on which to write the DER encoding.
-     *
-     * @exception IOException on encoding error.
      */
     @Override
-    public void encode(DerOutputStream out) throws IOException {
+    public void encode(DerOutputStream out) {
-        out.write(signedCert.clone());
+        out.writeBytes(signedCert);
     }
 
     /**
@@ -468,35 +466,31 @@ public class X509CertImpl extends X509Certificate implements DerEncoder {
     public static X509CertImpl newSigned(X509CertInfo info, PrivateKey key, String algorithm, String provider)
             throws CertificateException, NoSuchAlgorithmException,
             InvalidKeyException, NoSuchProviderException, SignatureException {
-        try {
+        Signature sigEngine = SignatureUtil.fromKey(
-            Signature sigEngine = SignatureUtil.fromKey(
+                algorithm, key, provider);
-                    algorithm, key, provider);
+        AlgorithmId algId = SignatureUtil.fromSignature(sigEngine, key);
-            AlgorithmId algId = SignatureUtil.fromSignature(sigEngine, key);
 
-            DerOutputStream out = new DerOutputStream();
+        DerOutputStream out = new DerOutputStream();
-            DerOutputStream tmp = new DerOutputStream();
+        DerOutputStream tmp = new DerOutputStream();
 
-            // encode certificate info
+        // encode certificate info
-            info.setAlgorithmId(new CertificateAlgorithmId(algId));
+        info.setAlgorithmId(new CertificateAlgorithmId(algId));
-            info.encode(tmp);
+        info.encode(tmp);
-            byte[] rawCert = tmp.toByteArray();
+        byte[] rawCert = tmp.toByteArray();
 
-            // encode algorithm identifier
+        // encode algorithm identifier
-            algId.encode(tmp);
+        algId.encode(tmp);
 
-            // Create and encode the signature itself.
+        // Create and encode the signature itself.
-            sigEngine.update(rawCert, 0, rawCert.length);
+        sigEngine.update(rawCert, 0, rawCert.length);
-            byte[] signature = sigEngine.sign();
+        byte[] signature = sigEngine.sign();
-            tmp.putBitString(signature);
+        tmp.putBitString(signature);
 
-            // Wrap the signed data in a SEQUENCE { data, algorithm, sig }
+        // Wrap the signed data in a SEQUENCE { data, algorithm, sig }
-            out.write(DerValue.tag_Sequence, tmp);
+        out.write(DerValue.tag_Sequence, tmp);
-            byte[] signedCert = out.toByteArray();
+        byte[] signedCert = out.toByteArray();
 
-            return new X509CertImpl(info, algId, signature, signedCert);
+        return new X509CertImpl(info, algId, signature, signedCert);
-        } catch (IOException e) {
-            throw new CertificateEncodingException(e.toString());
-        }
     }
 
     /**
@@ -1253,13 +1247,7 @@ public class X509CertImpl extends X509Certificate implements DerEncoder {
             default:
                 // add DER encoded form
                 DerOutputStream derOut = new DerOutputStream();
-                try {
+                name.encode(derOut);
-                    name.encode(derOut);
-                } catch (IOException ioe) {
-                    // should not occur since name has already been decoded
-                    // from cert (this would indicate a bug in our code)
-                    throw new RuntimeException("name cannot be encoded", ioe);
-                }
                 nameEntry.add(derOut.toByteArray());
                 if (name.getType() == GeneralNameInterface.NAME_ANY
                         && name instanceof OtherName oname) {

src/java.base/share/classes/sun/security/x509/X509CertInfo.java

@@ -145,15 +145,14 @@ public class X509CertInfo {
      *
      * @param out an output stream to which the certificate is appended.
      * @exception CertificateException on encoding errors.
-     * @exception IOException on other errors.
      */
     public void encode(DerOutputStream out)
-            throws CertificateException, IOException {
+            throws CertificateException {
         if (rawCertInfo == null) {
             emit(out);
             rawCertInfo = out.toByteArray();
         } else {
-            out.write(rawCertInfo.clone());
+            out.writeBytes(rawCertInfo.clone());
         }
     }
 
@@ -170,7 +169,7 @@ public class X509CertInfo {
                 rawCertInfo = tmp.toByteArray();
             }
             return rawCertInfo.clone();
-        } catch (IOException | CertificateException e) {
+        } catch (CertificateException e) {
             throw new CertificateEncodingException(e.toString());
         }
     }
@@ -464,8 +463,7 @@ public class X509CertInfo {
     /*
      * Marshal the contents of a "raw" certificate into a DER sequence.
      */
-    private void emit(DerOutputStream out)
+    private void emit(DerOutputStream out) throws CertificateException {
-    throws CertificateException, IOException {
         DerOutputStream tmp = new DerOutputStream();
 
         // version number, iff not V1

src/java.base/share/classes/sun/security/x509/X509Key.java

@@ -55,7 +55,7 @@ import sun.security.util.*;
  *
  * @author David Brownell
  */
-public class X509Key implements PublicKey {
+public class X509Key implements PublicKey, DerEncoder {
 
     /** use serialVersionUID from JDK 1.1. for interoperability */
     @java.io.Serial
@@ -100,8 +100,7 @@ public class X509Key implements PublicKey {
      * data is stored and transmitted losslessly, but no knowledge
      * about this particular algorithm is available.
      */
-    private X509Key(AlgorithmId algid, BitArray key)
+    private X509Key(AlgorithmId algid, BitArray key) {
-    throws InvalidKeyException {
         this.algid = algid;
         setKey(key);
         encode();
@@ -190,10 +189,9 @@ public class X509Key implements PublicKey {
      * values using the X509Key member functions, such as <code>parse</code>
      * and <code>decode</code>.
      *
-     * @exception IOException on parsing errors.
      * @exception InvalidKeyException on invalid key encodings.
      */
-    protected void parseKeyBits() throws IOException, InvalidKeyException {
+    protected void parseKeyBits() throws InvalidKeyException {
         encode();
     }
 
@@ -287,11 +285,9 @@ public class X509Key implements PublicKey {
 
     /**
      * Encode SubjectPublicKeyInfo sequence on the DER output stream.
-     *
-     * @exception IOException on encoding errors.
      */
-    public final void encode(DerOutputStream out) throws IOException
+    @Override
-    {
+    public final void encode(DerOutputStream out) {
         encode(out, this.algid, getKey());
     }
 
@@ -299,26 +295,15 @@ public class X509Key implements PublicKey {
      * Returns the DER-encoded form of the key as a byte array.
      */
     public byte[] getEncoded() {
-        try {
+        return getEncodedInternal().clone();
-            return getEncodedInternal().clone();
-        } catch (InvalidKeyException e) {
-            // XXX
-        }
-        return null;
     }
 
-    public byte[] getEncodedInternal() throws InvalidKeyException {
+    public byte[] getEncodedInternal() {
         byte[] encoded = encodedKey;
         if (encoded == null) {
-            try {
+            DerOutputStream out = new DerOutputStream();
-                DerOutputStream out = new DerOutputStream();
+            encode(out);
-                encode(out);
+            encodedKey = encoded = out.toByteArray();
-                encoded = out.toByteArray();
-            } catch (IOException e) {
-                throw new InvalidKeyException("IOException : " +
-                                               e.getMessage());
-            }
-            encodedKey = encoded;
         }
         return encoded;
     }
@@ -332,10 +317,8 @@ public class X509Key implements PublicKey {
 
     /**
      * Returns the DER-encoded form of the key as a byte array.
-     *
-     * @exception InvalidKeyException on encoding errors.
      */
-    public byte[] encode() throws InvalidKeyException {
+    public byte[] encode() {
         return getEncodedInternal().clone();
     }
 
@@ -428,18 +411,14 @@ public class X509Key implements PublicKey {
         if (!(obj instanceof Key)) {
             return false;
         }
-        try {
+        byte[] thisEncoded = this.getEncodedInternal();
-            byte[] thisEncoded = this.getEncodedInternal();
+        byte[] otherEncoded;
-            byte[] otherEncoded;
+        if (obj instanceof X509Key) {
-            if (obj instanceof X509Key) {
+            otherEncoded = ((X509Key) obj).getEncodedInternal();
-                otherEncoded = ((X509Key)obj).getEncodedInternal();
+        } else {
-            } else {
+            otherEncoded = ((Key) obj).getEncoded();
-                otherEncoded = ((Key)obj).getEncoded();
-            }
-            return Arrays.equals(thisEncoded, otherEncoded);
-        } catch (InvalidKeyException e) {
-            return false;
         }
+        return Arrays.equals(thisEncoded, otherEncoded);
     }
 
     /**
@@ -447,24 +426,18 @@ public class X509Key implements PublicKey {
      * which are equal will also have the same hashcode.
      */
     public int hashCode() {
-        try {
+        byte[] b1 = getEncodedInternal();
-            byte[] b1 = getEncodedInternal();
+        int r = b1.length;
-            int r = b1.length;
+        for (int i = 0; i < b1.length; i++) {
-            for (int i = 0; i < b1.length; i++) {
+            r += (b1[i] & 0xff) * 37;
-                r += (b1[i] & 0xff) * 37;
-            }
-            return r;
-        } catch (InvalidKeyException e) {
-            // should not happen
-            return 0;
         }
+        return r;
     }
 
     /*
      * Produce SubjectPublicKey encoding from algorithm id and key material.
      */
-    static void encode(DerOutputStream out, AlgorithmId algid, BitArray key)
+    static void encode(DerOutputStream out, AlgorithmId algid, BitArray key) {
-        throws IOException {
             DerOutputStream tmp = new DerOutputStream();
             algid.encode(tmp);
             tmp.putUnalignedBitString(key);

src/java.security.jgss/share/classes/org/ietf/jgss/Oid.java

@@ -174,13 +174,12 @@ public class Oid {
      */
     public byte[] getDER() throws GSSException {
 
+        // Since JDK-8297065, this method no longer throws a GSSException.
+        // The throws clause in the method definition might be removed in
+        // a future Java GSS-API update.
         if (derEncoding == null) {
             DerOutputStream dout = new DerOutputStream();
-            try {
+            dout.putOID(oid);
-                dout.putOID(oid);
-            } catch (IOException e) {
-                throw new GSSException(GSSException.FAILURE, e.getMessage());
-            }
             derEncoding = dout.toByteArray();
         }
 

src/java.security.jgss/share/classes/sun/security/jgss/GSSHeader.java

@@ -155,12 +155,9 @@ public class GSSHeader {
                                           int maxTotalSize) {
 
         int mechOidBytesSize = 0;
-        try {
+        DerOutputStream temp = new DerOutputStream();
-            DerOutputStream temp = new DerOutputStream();
+        temp.putOID(mechOid);
-            temp.putOID(mechOid);
+        mechOidBytesSize = temp.toByteArray().length;
-            mechOidBytesSize = temp.toByteArray().length;
-        } catch (IOException ignored) {
-        }
 
         // Subtract bytes needed for 0x60 tag and mechOidBytes
         maxTotalSize -= (1 + mechOidBytesSize);

src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java

@@ -408,13 +408,7 @@ public final class GSSNameImpl implements GSSName {
                                        "Invalid OID String ");
         }
         DerOutputStream dout = new DerOutputStream();
-        try {
+        dout.putOID(oid);
-            dout.putOID(oid);
-        } catch (IOException e) {
-            throw new GSSExceptionImpl(GSSException.FAILURE,
-                                   "Could not ASN.1 Encode "
-                                   + oid.toString());
-        }
         oidBytes = dout.toByteArray();
 
         byte[] retVal = new byte[2

src/java.security.jgss/share/classes/sun/security/jgss/spnego/NegTokenInit.java

@@ -88,55 +88,49 @@ public class NegTokenInit extends SpNegoToken {
         parseToken(in);
     }
 
-    final byte[] encode() throws GSSException {
+    final byte[] encode() {
-        try {
+        // create negInitToken
-            // create negInitToken
+        DerOutputStream initToken = new DerOutputStream();
-            DerOutputStream initToken = new DerOutputStream();
 
-            // DER-encoded mechTypes with CONTEXT 00
+        // DER-encoded mechTypes with CONTEXT 00
-            if (mechTypes != null) {
+        if (mechTypes != null) {
-                initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
+            initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
-                                                true, (byte) 0x00), mechTypes);
+                    true, (byte) 0x00), mechTypes);
-            }
-
-            // write context flags with CONTEXT 01
-            if (reqFlags != null) {
-                DerOutputStream flags = new DerOutputStream();
-                flags.putUnalignedBitString(reqFlags);
-                initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
-                                                true, (byte) 0x01), flags);
-            }
-
-            // mechToken with CONTEXT 02
-            if (mechToken != null) {
-                DerOutputStream dataValue = new DerOutputStream();
-                dataValue.putOctetString(mechToken);
-                initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
-                                                true, (byte) 0x02), dataValue);
-            }
-
-            // mechListMIC with CONTEXT 03
-            if (mechListMIC != null) {
-                if (DEBUG) {
-                    System.out.println("SpNegoToken NegTokenInit: " +
-                                        "sending MechListMIC");
-                }
-                DerOutputStream mic = new DerOutputStream();
-                mic.putOctetString(mechListMIC);
-                initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
-                                                true, (byte) 0x03), mic);
-            }
-
-            // insert in a SEQUENCE
-            DerOutputStream out = new DerOutputStream();
-            out.write(DerValue.tag_Sequence, initToken);
-
-            return out.toByteArray();
-
-        } catch (IOException e) {
-            throw new GSSException(GSSException.DEFECTIVE_TOKEN, -1,
-                "Invalid SPNEGO NegTokenInit token : " + e.getMessage());
         }
+
+        // write context flags with CONTEXT 01
+        if (reqFlags != null) {
+            DerOutputStream flags = new DerOutputStream();
+            flags.putUnalignedBitString(reqFlags);
+            initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
+                    true, (byte) 0x01), flags);
+        }
+
+        // mechToken with CONTEXT 02
+        if (mechToken != null) {
+            DerOutputStream dataValue = new DerOutputStream();
+            dataValue.putOctetString(mechToken);
+            initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
+                    true, (byte) 0x02), dataValue);
+        }
+
+        // mechListMIC with CONTEXT 03
+        if (mechListMIC != null) {
+            if (DEBUG) {
+                System.out.println("SpNegoToken NegTokenInit: " +
+                        "sending MechListMIC");
+            }
+            DerOutputStream mic = new DerOutputStream();
+            mic.putOctetString(mechListMIC);
+            initToken.write(DerValue.createTag(DerValue.TAG_CONTEXT,
+                    true, (byte) 0x03), mic);
+        }
+
+        // insert in a SEQUENCE
+        DerOutputStream out = new DerOutputStream();
+        out.write(DerValue.tag_Sequence, initToken);
+
+        return out.toByteArray();
     }
 
     private void parseToken(byte[] in) throws GSSException {