Replace deprecated "denigrated" `java.security.cert` APIs that represent DNs as Principal or String objects. `JDK-8250970`

    /**
     * Gets the {@code subject} (subject distinguished name) value
     * from the certificate.  If the {@code subject} value is empty,
     * then the {@code getName()} method of the returned
     * {@code Principal} object returns an empty string ("").
     *
     * <p> The ASN.1 definition for this is:
     * <pre>
     * subject    Name
     * </pre>
     *
     * <p>See {@link #getIssuerDN() getIssuerDN} for {@code Name}
     * and other relevant definitions.
     *
     * @return a Principal whose name is the subject name.
     *
     * @deprecated Use {@link #getSubjectX500Principal} instead. This method
     * returns the {@code subject} as an implementation specific
     * {@code Principal} object, which should not be relied upon by portable
     * code.
     */
    @Deprecated(since="16")
    public abstract Principal getSubjectDN();

    /**
     * Returns the subject (subject distinguished name) value from the
     * certificate as an {@code X500Principal}.  If the subject value
     * is empty, then the {@code getName()} method of the returned
     * {@code X500Principal} object returns an empty string ("").
     * <p>
     * It is recommended that subclasses override this method.
     *
     * @return an {@code X500Principal} representing the subject
     *          distinguished name
     * @since 1.4
     */
    public X500Principal getSubjectX500Principal() {
        if (subjectX500Principal == null) {
            subjectX500Principal = X509CertImpl.getSubjectX500Principal(this);
        }
        return subjectX500Principal;
    }

Other deprecations : https://bugs.openjdk.org/browse/JDK-8250970

Start with JDK-8250970 to identify the deprecated java.security.cert APIs covered beyond the getSubjectDN example. Then locate the corresponding migration recipe entry points in this repository and determine how each API should be replaced, including getSubjectDN with getSubjectX500Principal. Done means the deprecated DN representations listed by the issue are covered by the migration recipe.