We are not only loading certificates from JRE keystore, but also Browser keystore, loading certificate from JRE keystore is taking longer than browser keystore, and in most scenario, we will find match in browser keystore. We should loading browser keystore first, do comparison, and only loading JRE keystore if no match is found.