javax.security.auth.x500.X500Principal has 2 constructors and 1 method
that throw checked exceptions, but do not need to:

1) public X500Principal(byte[] name) throws IOException
2) public X500Principal(InputStream is) throws IOException
3) public byte[] getEncoded() throws IOException

in the case of the constructors, if the input name is
incorrectly formatted or improperly specified, the documentation
should specify an IllegalArgumentException will be thrown.

in the case of getEncoded, this method should normally
succeed. failure would constitute a rare occurrence
and would warrant a RuntimeException to be thrown.

java.security.cert.X509Certificate has 2 methods
that throw checked exceptions, but do not need to:

1) public X500Principal getSubjectX500Principal()
throws CertificateException
2) public X500Principal getIssuerX500Principal()
throws CertificateException

these methods should normally succeed. failure would
constitute a rare occurrence and would warrant a
RuntimeException to be thrown.

java.security.cert.X509CRL has 1 method
that throws a checked exception, but does not need to:

1) public X500Principal getIssuerX500Principal()
throws CRLException

this method should normally succeed. failure would
constitute a rare occurrence and would warrant a
RuntimeException to be thrown.