diff --git a/jdk/src/share/classes/java/security/KeyStore.java b/jdk/src/share/classes/java/security/KeyStore.java
index 68df16ed113..c363d0719f7 100644
--- a/jdk/src/share/classes/java/security/KeyStore.java
+++ b/jdk/src/share/classes/java/security/KeyStore.java
@@ -227,15 +227,13 @@ public class KeyStore {
      * {@link #store(KeyStore.LoadStoreParameter) store} operations.
      * <p>
      * The following syntax is supported for configuration data:
-     * <pre>
-     *
+     * <pre>{@code
      *     domain <domainName> [<property> ...] {
      *         keystore <keystoreName> [<property> ...] ;
      *         ...
      *     };
      *     ...
-     *
-     * </pre>
+     * }</pre>
      * where {@code domainName} and {@code keystoreName} are identifiers
      * and {@code property} is a key/value pairing. The key and value are
      * separated by an 'equals' symbol and the value is enclosed in double
diff --git a/jdk/src/share/classes/java/security/Provider.java b/jdk/src/share/classes/java/security/Provider.java
index 54cf9327d1d..89a7b492669 100644
--- a/jdk/src/share/classes/java/security/Provider.java
+++ b/jdk/src/share/classes/java/security/Provider.java
@@ -67,6 +67,7 @@ import java.lang.reflect.*;
  * or modified by applications.
  * The following attributes are automatically placed in each Provider object:
  * <table cellspacing=4>
+ * <caption><b>Attributes Automatically Placed in a Provider Object</b></caption>
  * <tr><th>Name</th><th>Value</th>
  * <tr><td>{@code Provider.id name}</td>
   *    <td>{@code String.valueOf(provider.getName())}</td>
diff --git a/jdk/src/share/classes/java/security/Security.java b/jdk/src/share/classes/java/security/Security.java
index c3dd716058d..98699da8149 100644
--- a/jdk/src/share/classes/java/security/Security.java
+++ b/jdk/src/share/classes/java/security/Security.java
@@ -480,8 +480,8 @@ public final class Security {
      * Returns an array containing all installed providers that satisfy the
      * specified selection criterion, or null if no such providers have been
      * installed. The returned providers are ordered
-     * according to their <a href=
-     * "#insertProviderAt(java.security.Provider, int)">preference order</a>.
+     * according to their
+     * {@linkplain #insertProviderAt(java.security.Provider, int) preference order}.
      *
      * <p> A cryptographic service is always associated with a particular
      * algorithm or type. For example, a digital signature service is
@@ -492,8 +492,8 @@ public final class Security {
      * <p>The selection criterion must be specified in one of the following two
      * formats:
      * <ul>
-     * <li> <i>&lt;crypto_service>.&lt;algorithm_or_type></i> <p> The
-     * cryptographic service name must not contain any dots.
+     * <li> <i>{@literal <crypto_service>.<algorithm_or_type>}</i>
+     * <p> The cryptographic service name must not contain any dots.
      * <p> A
      * provider satisfies the specified selection criterion iff the provider
      * implements the
@@ -501,11 +501,12 @@ public final class Security {
      * <p> For example, "CertificateFactory.X.509"
      * would be satisfied by any provider that supplied
      * a CertificateFactory implementation for X.509 certificates.
-     * <li> <i>&lt;crypto_service>.&lt;algorithm_or_type>
-     * &lt;attribute_name>:&lt attribute_value></i>
+     * <li> <i>{@literal <crypto_service>.<algorithm_or_type>
+     * <attribute_name>:<attribute_value>}</i>
      * <p> The cryptographic service name must not contain any dots. There
      * must be one or more space charaters between the
-     * <i>&lt;algorithm_or_type></i> and the <i>&lt;attribute_name></i>.
+     * <i>{@literal <algorithm_or_type>}</i> and the
+     * <i>{@literal <attribute_name>}</i>.
      *  <p> A provider satisfies this selection criterion iff the
      * provider implements the specified algorithm or type for the specified
      * cryptographic service and its implementation meets the
@@ -558,8 +559,9 @@ public final class Security {
      * Returns an array containing all installed providers that satisfy the
      * specified* selection criteria, or null if no such providers have been
      * installed. The returned providers are ordered
-     * according to their <a href=
-     * "#insertProviderAt(java.security.Provider, int)">preference order</a>.
+     * according to their
+     * {@linkplain #insertProviderAt(java.security.Provider, int)
+     * preference order}.
      *
      * <p>The selection criteria are represented by a map.
      * Each map entry represents a selection criterion.
@@ -567,16 +569,18 @@ public final class Security {
      * criteria. The key for any entry in such a map must be in one of the
      * following two formats:
      * <ul>
-     * <li> <i>&lt;crypto_service>.&lt;algorithm_or_type></i>
+     * <li> <i>{@literal <crypto_service>.<algorithm_or_type>}</i>
      * <p> The cryptographic service name must not contain any dots.
      * <p> The value associated with the key must be an empty string.
      * <p> A provider
      * satisfies this selection criterion iff the provider implements the
      * specified algorithm or type for the specified cryptographic service.
-     * <li>  <i>&lt;crypto_service>.&lt;algorithm_or_type> &lt;attribute_name></i>
+     * <li>  <i>{@literal <crypto_service>}.
+     * {@literal <algorithm_or_type> <attribute_name>}</i>
      * <p> The cryptographic service name must not contain any dots. There
-     * must be one or more space charaters between the <i>&lt;algorithm_or_type></i>
-     * and the <i>&lt;attribute_name></i>.
+     * must be one or more space charaters between the
+     * <i>{@literal <algorithm_or_type>}</i>
+     * and the <i>{@literal <attribute_name>}</i>.
      * <p> The value associated with the key must be a non-empty string.
      * A provider satisfies this selection criterion iff the
      * provider implements the specified algorithm or type for the specified
diff --git a/jdk/src/share/classes/java/security/cert/X509CRL.java b/jdk/src/share/classes/java/security/cert/X509CRL.java
index 0909ac0a6e6..5ce84847fa5 100644
--- a/jdk/src/share/classes/java/security/cert/X509CRL.java
+++ b/jdk/src/share/classes/java/security/cert/X509CRL.java
@@ -249,7 +249,8 @@ public abstract class X509CRL extends CRL implements X509Extension {
      * The ASN.1 definition for this is:
      * <pre>
      * version    Version OPTIONAL,
-     *             -- if present, must be v2<p>
+     *             -- if present, must be v2
+     *
      * Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
      *             -- v3 does not apply to CRLs but appears for consistency
      *             -- with definition of Version for certs
@@ -413,7 +414,8 @@ public abstract class X509CRL extends CRL implements X509Extension {
      * signature algorithm. An example is the string "SHA256withRSA".
      * The ASN.1 definition for this is:
      * <pre>
-     * signatureAlgorithm   AlgorithmIdentifier<p>
+     * signatureAlgorithm   AlgorithmIdentifier
+     *
      * AlgorithmIdentifier  ::=  SEQUENCE  {
      *     algorithm               OBJECT IDENTIFIER,
      *     parameters              ANY DEFINED BY algorithm OPTIONAL  }
diff --git a/jdk/src/share/classes/java/security/cert/X509CRLEntry.java b/jdk/src/share/classes/java/security/cert/X509CRLEntry.java
index f355f62bcb8..268fa819587 100644
--- a/jdk/src/share/classes/java/security/cert/X509CRLEntry.java
+++ b/jdk/src/share/classes/java/security/cert/X509CRLEntry.java
@@ -43,11 +43,11 @@ import sun.security.x509.X509CRLEntryImpl;
  *     crlEntryExtensions Extensions OPTIONAL
  *                        -- if present, must be v2
  * }  OPTIONAL
- *<p>
+ *
  * CertificateSerialNumber  ::=  INTEGER
- *<p>
+ *
  * Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
- *<p>
+ *
  * Extension  ::=  SEQUENCE  {
  *     extnId        OBJECT IDENTIFIER,
  *     critical      BOOLEAN DEFAULT FALSE,
diff --git a/jdk/src/share/classes/java/security/cert/X509Certificate.java b/jdk/src/share/classes/java/security/cert/X509Certificate.java
index 9094dfcc95d..0aba5da60c0 100644
--- a/jdk/src/share/classes/java/security/cert/X509Certificate.java
+++ b/jdk/src/share/classes/java/security/cert/X509Certificate.java
@@ -126,10 +126,12 @@ implements X509Extension {
      * is valid. It is defined in
      * ASN.1 as:
      * <pre>
-     * validity             Validity<p>
+     * validity             Validity
+     *
      * Validity ::= SEQUENCE {
      *     notBefore      CertificateValidityDate,
-     *     notAfter       CertificateValidityDate }<p>
+     *     notAfter       CertificateValidityDate }
+     *
      * CertificateValidityDate ::= CHOICE {
      *     utcTime        UTCTime,
      *     generalTime    GeneralizedTime }
@@ -165,7 +167,8 @@ implements X509Extension {
      * certificate.
      * The ASN.1 definition for this is:
      * <pre>
-     * version  [0] EXPLICIT Version DEFAULT v1<p>
+     * version  [0] EXPLICIT Version DEFAULT v1
+     *
      * Version ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
      * </pre>
      * @return the version number, i.e. 1, 2 or 3.
@@ -180,7 +183,7 @@ implements X509Extension {
      * serial number identify a unique certificate).
      * The ASN.1 definition for this is:
      * <pre>
-     * serialNumber     CertificateSerialNumber<p>
+     * serialNumber     CertificateSerialNumber
      *
      * CertificateSerialNumber  ::=  INTEGER
      * </pre>
@@ -204,7 +207,7 @@ implements X509Extension {
      * X.500 distinguished name (DN).
      * The ASN.1 definition for this is:
      * <pre>
-     * issuer    Name<p>
+     * issuer    Name
      *
      * Name ::= CHOICE { RDNSequence }
      * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
@@ -295,11 +298,12 @@ implements X509Extension {
      * the certificate.
      * The relevant ASN.1 definitions are:
      * <pre>
-     * validity             Validity<p>
+     * validity             Validity
      *
      * Validity ::= SEQUENCE {
      *     notBefore      CertificateValidityDate,
-     *     notAfter       CertificateValidityDate }<p>
+     *     notAfter       CertificateValidityDate }
+     *
      * CertificateValidityDate ::= CHOICE {
      *     utcTime        UTCTime,
      *     generalTime    GeneralizedTime }
@@ -348,7 +352,8 @@ implements X509Extension {
      * signature algorithm. An example is the string "SHA256withRSA".
      * The ASN.1 definition for this is:
      * <pre>
-     * signatureAlgorithm   AlgorithmIdentifier<p>
+     * signatureAlgorithm   AlgorithmIdentifier
+     *
      * AlgorithmIdentifier  ::=  SEQUENCE  {
      *     algorithm               OBJECT IDENTIFIER,
      *     parameters              ANY DEFINED BY algorithm OPTIONAL  }
@@ -410,7 +415,8 @@ implements X509Extension {
      *
      * <p>The ASN.1 definition for this is:
      * <pre>
-     * issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL<p>
+     * issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL
+     *
      * UniqueIdentifier  ::=  BIT STRING
      * </pre>
      *
@@ -424,7 +430,8 @@ implements X509Extension {
      *
      * <p>The ASN.1 definition for this is:
      * <pre>
-     * subjectUniqueID  [2]  IMPLICIT UniqueIdentifier OPTIONAL<p>
+     * subjectUniqueID  [2]  IMPLICIT UniqueIdentifier OPTIONAL
+     *
      * UniqueIdentifier  ::=  BIT STRING
      * </pre>
      *
@@ -474,9 +481,9 @@ implements X509Extension {
      * indicated in the key usage extension field.  The ASN.1
      * definition for this is:
      * <pre>
-     * ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId<p>
+     * ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
      *
-     * KeyPurposeId ::= OBJECT IDENTIFIER<p>
+     * KeyPurposeId ::= OBJECT IDENTIFIER
      * </pre>
      *
      * Key purposes may be defined by any organization with a