[{"data":1,"prerenderedAt":2038},["ShallowReactive",2],{"services":3,"home-latest":776},[4,257,383,502,603,693],{"id":5,"title":6,"body":7,"category":238,"description":239,"engagement":240,"extension":241,"headline":242,"icon":243,"meta":244,"navigation":245,"order":246,"outcomes":247,"path":253,"seo":254,"stem":255,"__hash__":256},"services\u002Fservices\u002Fjvm-discovery.md","JVM Discovery & Estate Assessment",{"type":8,"value":9,"toc":228},"minimark",[10,15,24,27,31,34,79,83,93,125,129,206,210],[11,12,14],"h2",{"id":13},"the-problem","The problem",[16,17,18,19,23],"p",{},"Most enterprises can't produce an accurate, current list of the Java runtimes they run. The CMDB records some. Config management records others. The rest are ",[20,21,22],"strong",{},"shadow JVMs",": runtimes bundled inside vendor products, application servers, CI\u002FCD agents, monitoring tools, desktop software and container images that nobody thinks of as \"Java\".",[16,25,26],{},"Shadow JVMs are the ones that miss every patch cycle. For Oracle Java, they are also the installs that can put your entire headcount in scope for a subscription.",[11,28,30],{"id":29},"what-we-find","What we find",[16,32,33],{},"For every JVM across dev, staging and production we capture:",[35,36,37,44,50,56,62,68],"ul",{},[38,39,40,43],"li",{},[20,41,42],{},"Version, vendor and patch level",": Oracle JDK, Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat, Microsoft, IBM Semeru and others",[38,45,46,49],{},[20,47,48],{},"Where it is embedded",": standalone apps, Tomcat, WebLogic, WebSphere, JBoss\u002FWildFly, vendor products, containers",[38,51,52,55],{},[20,53,54],{},"CVE exposure",", mapped to each version and scored so the worst exposure rises to the top",[38,57,58,61],{},[20,59,60],{},"Installed agents",": APM, security and profiling agents, which cause many patch failures",[38,63,64,67],{},[20,65,66],{},"Ownership",": who actually runs each application. This is often the hardest part to get right.",[38,69,70,73,74],{},[20,71,72],{},"Criticality signals"," that feed ",[75,76,78],"a",{"href":77},"\u002Fapproach#classification","application classification",[11,80,82],{"id":81},"how-we-do-it","How we do it",[84,85,86],"note",{},[16,87,88,89,92],{},"Discovery is ",[20,90,91],{},"read-only",". Nothing is patched, restarted or deployed, so the engagement doesn't need change-control approval, and the access we ask for is kept to a minimum.",[35,94,95,101,107,113,119],{},[38,96,97,100],{},[20,98,99],{},"Agentless scanning"," over SSH and WinRM (process listings and filesystem inspection) where possible",[38,102,103,106],{},[20,104,105],{},"Reconciliation against your CMDB and config management"," (Ansible, Puppet, Chef). The drift between what is recorded and what is running is a finding in its own right.",[38,108,109,112],{},[20,110,111],{},"Cloud provider APIs"," (AWS, Azure, GCP) for instance and container metadata",[38,114,115,118],{},[20,116,117],{},"Container image and artifact repository scanning"," (registries, Nexus, Artifactory) to catch JVMs before they are even running",[38,120,121,124],{},[20,122,123],{},"Reuse of the scanners you already own",". Tenable, Qualys, Snyk and JFrog Xray already collect useful data. We add the JVM-specific interpretation and a remediation plan; we don't sell you another scanner.",[11,126,128],{"id":127},"three-ways-to-engage","Three ways to engage",[130,131,132,151],"table",{},[133,134,135],"thead",{},[136,137,138,142,145,148],"tr",{},[139,140,141],"th",{},"Package",[139,143,144],{},"Scope",[139,146,147],{},"Turnaround",[139,149,150],{},"Purpose",[152,153,154,171,187],"tbody",{},[136,155,156,162,165,168],{},[157,158,159],"td",{},[20,160,161],{},"Quick Scan",[157,163,164],{},"One business unit or subset of the estate",[157,166,167],{},"Days",[157,169,170],{},"Prove what a full assessment will find",[136,172,173,178,181,184],{},[157,174,175],{},[20,176,177],{},"Full Estate Assessment",[157,179,180],{},"The whole estate",[157,182,183],{},"2–4 weeks",[157,185,186],{},"Complete inventory, risk report and remediation plan",[136,188,189,197,200,203],{},[157,190,191],{},[20,192,193],{},[75,194,196],{"href":195},"\u002Fservices\u002Fdrift-monitoring","Continuous Drift Monitoring",[157,198,199],{},"Ongoing",[157,201,202],{},"Subscription",[157,204,205],{},"Keep the inventory, risk and license picture current",[11,207,209],{"id":208},"what-you-walk-away-with","What you walk away with",[16,211,212,213,217,218,222,223,227],{},"The executive summary puts the findings in business terms: unbudgeted license exposure, days of exposure on unpatched critical CVEs, and the percentage of the estate on end-of-life versions. It ends with a direct recommendation of which applications belong in ",[75,214,216],{"href":215},"\u002Fservices\u002Frapid-patch","Rapid Patch",", which need ",[75,219,221],{"href":220},"\u002Fservices\u002Fcritical-patch-assurance","Critical Patch Assurance",", and which Oracle installs to ",[75,224,226],{"href":225},"\u002Fservices\u002Fopenjdk-migration","migrate or keep",".",{"title":229,"searchDepth":230,"depth":231,"links":232},"",2,3,[233,234,235,236,237],{"id":13,"depth":230,"text":14},{"id":29,"depth":230,"text":30},{"id":81,"depth":230,"text":82},{"id":127,"depth":230,"text":128},{"id":208,"depth":230,"text":209},"jvm-discovery","Find every JVM in your estate, including the ones bundled inside vendor products and containers, and turn the findings into a prioritized, costed remediation plan.","Read-only and fixed-price. A Quick Scan of one business unit takes days; a Full Estate Assessment takes two to four weeks. Nothing changes in production, so no CAB approval is needed.","md","Start here","i-lucide-radar",{},true,1,[248,249,250,251,252],"A complete inventory of every JVM, with version, vendor, patch level and location","CVE exposure scored per JVM, not a raw vulnerability count","Oracle Java license exposure quantified in dollars","Owners mapped for each application","An executive summary with a prioritized remediation plan","\u002Fservices\u002Fjvm-discovery",{"title":6,"description":239},"services\u002Fjvm-discovery","xwCt4w5iuENInyc5KpzKLmV4sk8GzNe5e1H4Q9b7mV8",{"id":258,"title":259,"body":260,"category":368,"description":369,"engagement":370,"extension":241,"headline":371,"icon":372,"meta":373,"navigation":245,"order":230,"outcomes":374,"path":225,"seo":380,"stem":381,"__hash__":382},"services\u002Fservices\u002Fopenjdk-migration.md","Oracle Java Licensing & OpenJDK Migration",{"type":8,"value":261,"toc":358},[262,266,273,279,287,293,297,302,309,313,316,320,323,327,335,339],[11,263,265],{"id":264},"why-this-is-urgent","Why this is urgent",[16,267,268,269,272],{},"Since January 2023, Oracle has sold Java SE through the ",[20,270,271],{},"Java SE Universal Subscription",", which is priced per employee rather than per installation. The count covers full-time, part-time and temporary staff, plus contractors who support internal operations, however few machines actually run Oracle Java.",[16,274,275,276,227],{},"So a handful of forgotten Oracle JDK installs can put your whole headcount in scope. For example, an organization of 5,000 employees running Oracle Java on 40 servers can face a list-price bill of around ",[20,277,278],{},"$630,000 a year",[16,280,281,282,286],{},"The free window is closing too. Oracle's No-Fee Terms and Conditions (NFTC) cover each LTS release only until one year after the next LTS ships. For Oracle JDK 21, that window ",[75,283,285],{"href":284},"\u002Farticles\u002Fjava-21-nftc-free-period-ended","closed on September 16, 2026",". Continuing to patch it now requires a paid subscription.",[288,289,290],"warning",{},[16,291,292],{},"We are not lawyers, and nothing here is legal advice. Licensing terms and prices change; check them against Oracle's current price list and your own agreements. Where a formal licensing position is needed, we work alongside independent licensing specialists.",[11,294,296],{"id":295},"what-we-do","What we do",[298,299,301],"h3",{"id":300},"_1-quantify-the-exposure","1. Quantify the exposure",[16,303,304,305,308],{},"Using the ",[75,306,307],{"href":253},"discovery inventory",", we identify every Oracle JDK and JRE, how it got there, and whether it is covered by another product's license. Then we put a number on what it costs you.",[298,310,312],{"id":311},"_2-decide-install-by-install","2. Decide, install by install",[16,314,315],{},"Most Oracle installs have no reason to be Oracle. A few do: vendor certification requirements or specific support needs. We make that call explicitly for each install instead of by default.",[298,317,319],{"id":318},"_3-migrate","3. Migrate",[16,321,322],{},"OpenJDK builds from Eclipse Adoptium (Temurin), Amazon (Corretto), Azul (Zulu), Red Hat and Microsoft are TCK-tested and free to use in production. For same-version swaps, migration is usually low risk, but not zero risk. We check for the known differences: truststore contents, installer paths and registry keys, fonts, and old commercial-feature flags. Then we roll out progressively.",[298,324,326],{"id":325},"_4-prove-it","4. Prove it",[16,328,329,330,334],{},"Uninstalling is not the same as re-pointing ",[331,332,333],"code",{},"JAVA_HOME",". We verify that Oracle binaries are actually gone and keep the evidence, which you will want if Oracle ever asks.",[11,336,338],{"id":337},"further-reading","Further reading",[35,340,341,346,352],{},[38,342,343],{},[75,344,345],{"href":284},"Oracle JDK 21's free update window has closed",[38,347,348],{},[75,349,351],{"href":350},"\u002Farticles\u002Foracle-java-employee-metric-explained","Oracle's employee-based Java pricing, explained",[38,353,354],{},[75,355,357],{"href":356},"\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist","An Oracle JDK to OpenJDK migration checklist",{"title":229,"searchDepth":230,"depth":231,"links":359},[360,361,367],{"id":264,"depth":230,"text":265},{"id":295,"depth":230,"text":296,"children":362},[363,364,365,366],{"id":300,"depth":231,"text":301},{"id":311,"depth":231,"text":312},{"id":318,"depth":231,"text":319},{"id":325,"depth":231,"text":326},{"id":337,"depth":230,"text":338},"oracle-licensing","Quantify your Oracle Java SE exposure, then move every install that doesn't need Oracle onto a free, drop-in OpenJDK build, with evidence you can take to an audit or renewal.","Fixed-scope. We start from the discovery inventory, size your exposure, then migrate in waves. Low-criticality apps go first via Rapid Patch.","Often pays for itself","i-lucide-arrow-right-left",{},[375,376,377,378,379],"Your Oracle Java license exposure, in dollars, with the installs that drive it","A keep-or-migrate decision for every Oracle JDK install","Migration to Temurin, Corretto, Zulu, Red Hat or Microsoft builds of OpenJDK","Verified removal of Oracle binaries, with an evidence trail","Data to negotiate from ahead of an audit or renewal",{"title":259,"description":369},"services\u002Fopenjdk-migration","0aWf4Vd_7P0phaKwOWxq3bLjO4iX8gdRjDu_tPGAWBY",{"id":384,"title":216,"body":385,"category":488,"description":489,"engagement":490,"extension":241,"headline":491,"icon":492,"meta":493,"navigation":245,"order":231,"outcomes":494,"path":215,"seo":499,"stem":500,"__hash__":501},"services\u002Fservices\u002Frapid-patch.md",{"type":8,"value":386,"toc":482},[387,391,394,401,405,412,424,428,465,471,475],[11,388,390],{"id":389},"the-premise","The premise",[16,392,393],{},"Full regression testing before every JVM security patch is the main reason enterprise patch cycles take months. For business-critical systems that rigor is warranted. For the long tail of internal tools, batch jobs and low-traffic services it usually isn't. There it just delays the fix for a known CVE.",[16,395,396,397,400],{},"Rapid Patch ",[20,398,399],{},"does not skip testing",". It replaces pre-deployment regression testing with fast detection and fast rollback. If a bad patch is caught in minutes and reversed in minutes, running without an exhaustive test suite costs very little.",[11,402,404],{"id":403},"who-its-for","Who it's for",[16,406,407,408,411],{},"Applications that score below the critical threshold in our ",[75,409,410],{"href":77},"classification process",". This is a documented, weighted score with a named risk-acceptor, not an app owner's self-assessment. Apps near the threshold go to manual review.",[16,413,414,415,418,419,423],{},"Rapid Patch covers ",[20,416,417],{},"same-major security patches"," (for example 17.0.x to the next 17.0.x). Major version upgrades and vendor swaps are ",[75,420,422],{"href":421},"\u002Fapproach#patch-types","different engagements"," with a different risk profile.",[11,425,427],{"id":426},"how-it-works","How it works",[35,429,430,436,442,448,454],{},[38,431,432,435],{},[20,433,434],{},"Progressive rollout",": canary at 1%, then 10%, then 100%, gated on automated health checks",[38,437,438,441],{},[20,439,440],{},"Observability as the safety net",": error rates, latency, GC pause times, heap and thread behavior compared before and after the patch",[38,443,444,447],{},[20,445,446],{},"Fast, rehearsed rollback",": the previous runtime stays in place until the soak period ends, and rollback is exercised, not just written down",[38,449,450,453],{},[20,451,452],{},"Smoke tests and synthetic transactions"," for the paths that matter, in place of a full regression suite",[38,455,456,459,460,464],{},[20,457,458],{},"A pre-flight check"," for ",[75,461,463],{"href":462},"\u002Farticles\u002Fjvm-patch-failure-modes","known failure modes",": APM agents, TLS defaults, GC flags",[466,467,468],"tip",{},[16,469,470],{},"In many non-containerized estates, reliable rollback is the real gap. When that's the case we fix it first, because that step alone makes the patch cycle faster.",[11,472,474],{"id":473},"governance","Governance",[16,476,477,478],{},"Your Change Advisory Board approves the process once, as a standard change for a defined tier, instead of approving each patch. Every rollout produces evidence: which signals were checked, the results, timestamps, and who accepted the risk. ",[75,479,481],{"href":480},"\u002Farticles\u002Fcab-approval-for-faster-jvm-patching","How we get this past a CAB →",{"title":229,"searchDepth":230,"depth":231,"links":483},[484,485,486,487],{"id":389,"depth":230,"text":390},{"id":403,"depth":230,"text":404},{"id":426,"depth":230,"text":427},{"id":473,"depth":230,"text":474},"patch-management","Patch the long tail of non-business-critical Java apps in days, not quarters, by replacing full regression testing with progressive rollout, fast detection and rehearsed rollback.","Fixed-scope rollout of a patching pipeline and governance model for a defined tier of applications, followed by patch cycles run each quarter.","For non-critical apps","i-lucide-zap",{},[495,496,497,498],"Security patches applied across the tier in days after each quarterly release","Progressive rollout with automated health gates","A rollback path that has been tested, not just documented","A CAB-approved standard-change process and audit trail",{"title":216,"description":489},"services\u002Frapid-patch","qDIP1lgG0nnDOEyokq47L3LSfKbmYPHSlBnCXM3udLw",{"id":503,"title":221,"body":504,"category":588,"description":589,"engagement":590,"extension":241,"headline":591,"icon":592,"meta":593,"navigation":245,"order":594,"outcomes":595,"path":220,"seo":600,"stem":601,"__hash__":602},"services\u002Fservices\u002Fcritical-patch-assurance.md",{"type":8,"value":505,"toc":576},[506,510,517,523,527,531,534,538,541,545,548,552,555,559,562,566,569,573],[11,507,509],{"id":508},"a-different-promise","A different promise",[16,511,512,513,516],{},"For business-critical applications the value proposition flips. We aren't removing testing. We ",[20,514,515],{},"compress"," it so that each test cycle is shorter and gives you more confidence, and full rigor becomes possible on a faster cadence.",[16,518,519,520,522],{},"This is a different engagement from ",[75,521,216],{"href":215},", built on a different premise, not the same thing done more carefully.",[11,524,526],{"id":525},"whats-in-it","What's in it",[298,528,530],{"id":529},"test-impact-analysis-and-risk-based-test-selection","Test impact analysis and risk-based test selection",[16,532,533],{},"We use code coverage and change-impact analysis to find which of your existing regression tests actually exercise code paths affected by the JVM change, and run those on a compressed timeline. When the signal is ambiguous we escalate to the full suite.",[298,535,537],{"id":536},"shadow-traffic-and-dark-launch-testing","Shadow traffic and dark launch testing",[16,539,540],{},"We mirror real production traffic to a shadow instance running the patched JVM and diff its outputs against production, with no user exposure. This is the strongest \"test better, not less\" option available for critical services.",[298,542,544],{"id":543},"upgrade-readiness-assessment","Upgrade readiness assessment",[16,546,547],{},"Before any patch or upgrade, we scan for removed and deprecated API usage, known agent incompatibilities and dependency issues, and produce a risk report up front.",[298,549,551],{"id":550},"staging-and-production-parity-audits","Staging and production parity audits",[16,553,554],{},"Much critical-app patch risk comes from drift between staging and production, not from the patch itself. Closing that gap often gives you more than adding tests does.",[298,556,558],{"id":557},"canary-gates-on-business-metrics","Canary gates on business metrics",[16,560,561],{},"We go beyond latency and error rates to business invariants, such as transaction success rate, order completion and revenue per minute, and use them as automated rollback triggers.",[298,563,565],{"id":564},"patch-trains-and-war-room-support","Patch trains and war-room support",[16,567,568],{},"Scheduled, batched patch windows for critical apps, with dedicated live support during rollout, instead of ad hoc patching.",[298,570,572],{"id":571},"lts-aligned-strategy-and-vendor-coordination","LTS-aligned strategy and vendor coordination",[16,574,575],{},"Critical apps stay on designated LTS and security baselines, which keeps exposure windows short without constant churn. Where it matters, we work directly with your JVM vendor on compatibility and support commitments.",{"title":229,"searchDepth":230,"depth":231,"links":577},[578,579],{"id":508,"depth":230,"text":509},{"id":525,"depth":230,"text":526,"children":580},[581,582,583,584,585,586,587],{"id":529,"depth":231,"text":530},{"id":536,"depth":231,"text":537},{"id":543,"depth":231,"text":544},{"id":550,"depth":231,"text":551},{"id":557,"depth":231,"text":558},{"id":564,"depth":231,"text":565},{"id":571,"depth":231,"text":572},"risk-governance","For business-critical Java applications, we compress testing instead of removing it, so full rigor fits a faster patch cadence.","A higher-touch engagement for critical applications, typically starting with an upgrade-readiness assessment and continuing with scheduled patch trains.","For the apps that run the business","i-lucide-shield",{},4,[596,597,598,599],"Shorter test cycles for critical apps with the same or greater confidence","Shadow-traffic validation with no user exposure","Canary gates on business metrics, not just infrastructure metrics","Scheduled patch trains with live war-room support",{"title":221,"description":589},"services\u002Fcritical-patch-assurance","utoXA8F7946svO9yfDqjkPV5VtPJhDVhuelRoxSfZeU",{"id":604,"title":605,"body":606,"category":676,"description":677,"engagement":678,"extension":241,"headline":679,"icon":680,"meta":681,"navigation":245,"order":682,"outcomes":683,"path":689,"seo":690,"stem":691,"__hash__":692},"services\u002Fservices\u002Fthird-party-applications.md","Vendor & Third-Party Application JVMs",{"type":8,"value":607,"toc":672},[608,612,622,625,627,667],[11,609,611],{"id":610},"the-jvms-nobody-owns","The JVMs nobody owns",[16,613,614,615,618,619,227],{},"A large share of the Java in an enterprise wasn't written there. Application servers, database tooling, CI\u002FCD servers, monitoring agents, ETL tools, security appliances and desktop software often ship their ",[20,616,617],{},"own private JVM",", installed outside the package manager and invisible to anything that only checks the system ",[331,620,621],{},"java",[16,623,624],{},"These runtimes fall between two chairs. The platform team assumes the vendor patches them; the vendor assumes you'll apply their next release; the application owner assumes it's all fine. Meanwhile the bundled JVM ages.",[11,626,296],{"id":295},[35,628,629,639,645,655,661],{},[38,630,631,634,635,638],{},[20,632,633],{},"Find and attribute them."," ",[75,636,637],{"href":253},"Discovery"," surfaces bundled runtimes and ties each one to a product, version and business owner.",[38,640,641,644],{},[20,642,643],{},"Establish the supportability position."," For each product: does the vendor ship JVM updates, do they support replacing the bundled runtime, and which JDK builds do they certify?",[38,646,647,650,651,654],{},[20,648,649],{},"Patch what can be patched."," Through vendor updates or supported runtime swaps, rolled out with the same ",[75,652,653],{"href":215},"detection and rollback discipline"," as your own apps.",[38,656,657,660],{},[20,658,659],{},"Protect what can't."," Network isolation, disabling vulnerable features, tighter access. The compensating controls are documented so your risk register reflects reality.",[38,662,663,666],{},[20,664,665],{},"Take it to the vendor."," Certified-JDK questions, SBOM requests and patch-timeline commitments, backed by the specific evidence you need for a contract conversation.",[84,668,669],{},[16,670,671],{},"Some commercial products include a restricted Oracle Java license for use with that product only. Whether a bundled Oracle runtime creates licensing exposure depends on the product's terms, so we check them rather than assuming either way.",{"title":229,"searchDepth":230,"depth":231,"links":673},[674,675],{"id":610,"depth":230,"text":611},{"id":295,"depth":230,"text":296},"third-party-apps","Advisory for the Java you don't build yourself, including commercial products, appliances and vendor-bundled runtimes, so they get patched or protected instead of forgotten.","Advisory engagement scoped per vendor portfolio, usually following a discovery engagement that surfaces the bundled runtimes.","Second- and third-party apps","i-lucide-package",{},5,[684,685,686,687],"Every vendor-bundled JVM identified and attributed to a product and owner","A supportability position for each (vendor update, supported JRE swap or neither)","Compensating controls where patching isn't possible",{"Vendor asks backed by evidence":688},"certified JDKs, SBOMs, patch timelines","\u002Fservices\u002Fthird-party-applications",{"title":605,"description":677},"services\u002Fthird-party-applications","oy1ThKLwcn-G3Z5DaUWp8Maj1EXsbbInm5duRfzyfRs",{"id":694,"title":196,"body":695,"category":238,"description":763,"engagement":764,"extension":241,"headline":202,"icon":765,"meta":766,"navigation":245,"order":767,"outcomes":768,"path":195,"seo":773,"stem":774,"__hash__":775},"services\u002Fservices\u002Fdrift-monitoring.md",{"type":8,"value":696,"toc":758},[697,701,704,707,711,747,751],[11,698,700],{"id":699},"assessments-go-stale","Assessments go stale",[16,702,703],{},"An estate assessment is accurate the day it's delivered. After that, teams deploy new services, vendors ship updates with new bundled runtimes, someone installs Oracle JDK on a build agent, and a new CVE lands against a version you thought was fine.",[16,705,706],{},"Continuous Drift Monitoring keeps the picture current. The inventory becomes a system of record instead of a PDF.",[11,708,710],{"id":709},"what-it-watches","What it watches",[35,712,713,719,725,731,737],{},[38,714,715,718],{},[20,716,717],{},"New and undocumented JVMs"," across hosts, containers and artifact repositories",[38,720,721,724],{},[20,722,723],{},"Patch-level drift",": which runtimes fell behind after each quarterly critical patch update",[38,726,727,730],{},[20,728,729],{},"New CVEs"," against the versions and dependencies you actually run",[38,732,733,736],{},[20,734,735],{},"License exposure changes",": a new Oracle JDK install is flagged before it shows up in an audit",[38,738,739,742,743,746],{},[20,740,741],{},"Classification triggers",", such as a new regulated data flow, a traffic spike or an incident, which force an application's ",[75,744,745],{"href":77},"risk tier"," to be re-scored",[11,748,750],{"id":749},"how-its-delivered","How it's delivered",[16,752,753,754,757],{},"Collection reuses the minimum-privilege methods from the ",[75,755,756],{"href":253},"original assessment",". Findings go to a shared dashboard and to the channels your teams already use. Each quarter, aligned to the Java patch calendar, we review drift, exposure and upcoming end-of-life dates with you.",{"title":229,"searchDepth":230,"depth":231,"links":759},[760,761,762],{"id":699,"depth":230,"text":700},{"id":709,"depth":230,"text":710},{"id":749,"depth":230,"text":750},"Keep your JVM inventory, patch posture and Oracle license exposure current as the estate changes, instead of commissioning a new assessment every year.","Ongoing subscription after an estate assessment. Continuous collection, alerting on meaningful changes, and a quarterly review aligned to the Java patch calendar.","i-lucide-refresh-cw",{},6,[769,770,771,772],"New and undocumented JVMs detected as they appear","Patch-level drift tracked against each quarterly release","Alerts when a new install creates Oracle license exposure","Automatic re-classification when an app's risk profile changes",{"title":196,"description":763},"services\u002Fdrift-monitoring","Phmhi-GcB9IZ5dN4HFjsW_dg9QF_D9rXUNzILnRNAKE",[777,1191,1551],{"id":778,"title":779,"author":780,"body":781,"category":368,"date":1177,"description":1178,"draft":1179,"extension":241,"featured":245,"image":1180,"meta":1181,"navigation":245,"path":284,"readingTime":767,"seo":1182,"stem":1183,"tags":1184,"updated":1180,"__hash__":1190},"articles\u002Farticles\u002Fjava-21-nftc-free-period-ended.md","Oracle JDK 21's free update window has closed. Here's what that means.","patchmageddon-team",{"type":8,"value":782,"toc":1164},[783,786,789,793,796,811,814,875,878,882,885,891,897,900,906,909,913,916,919,933,936,941,945,949,952,958,962,965,968,972,975,998,1005,1009,1093,1096,1099,1103,1144,1149,1153],[16,784,785],{},"In September 2026, Oracle JDK 21 reached the end of its free commercial update window. If your organization runs Oracle JDK 21 in production and expects to keep patching it, the terms under which you receive those patches have changed.",[16,787,788],{},"This isn't a new policy. Oracle announced the model when it introduced the No-Fee Terms and Conditions (NFTC) license with JDK 17 in 2021, and the same thing happened to JDK 17 in 2024. Many teams treat \"Oracle made Java free again\" as a settled fact, though. For anyone on JDK 21 that is no longer true in the way that matters for security.",[11,790,792],{"id":791},"how-the-nftc-license-actually-works","How the NFTC license actually works",[16,794,795],{},"Starting with JDK 17, Oracle released Oracle JDK under the NFTC license, which allows free use, including commercial production use. The free period for each long-term support (LTS) release is time-limited:",[35,797,798,804],{},[38,799,800,801,227],{},"An LTS release gets NFTC updates until ",[20,802,803],{},"one year after the next LTS release ships",[38,805,806,807,810],{},"After that, further updates for that release are published under the ",[20,808,809],{},"Oracle Technology Network (OTN) License Agreement for Java SE",". OTN allows personal, development and some other uses, but production commercial use needs a paid Java SE subscription.",[16,812,813],{},"Applied to recent LTS releases:",[130,815,816,832],{},[133,817,818],{},[136,819,820,823,826,829],{},[139,821,822],{},"LTS release",[139,824,825],{},"GA",[139,827,828],{},"Free (NFTC) updates until",[139,830,831],{},"Updates after that",[152,833,834,848,861],{},[136,835,836,839,842,845],{},[157,837,838],{},"JDK 17",[157,840,841],{},"September 2021",[157,843,844],{},"September 2024",[157,846,847],{},"OTN (subscription for commercial production use)",[136,849,850,853,856,859],{},[157,851,852],{},"JDK 21",[157,854,855],{},"September 2023",[157,857,858],{},"September 2026",[157,860,847],{},[136,862,863,866,869,872],{},[157,864,865],{},"JDK 25",[157,867,868],{},"September 2025",[157,870,871],{},"Expected around September 2028, one year after the next LTS",[157,873,874],{},"OTN",[16,876,877],{},"The JDK 25 date depends on Oracle keeping its two-year LTS cadence and its current NFTC terms. Both are Oracle's decisions, so treat the date as an expectation, not a guarantee.",[11,879,881],{"id":880},"what-changed-precisely","What changed, precisely",[16,883,884],{},"This is where a lot of internal conversations go wrong, so it's worth being exact.",[16,886,887,890],{},[20,888,889],{},"Builds already released under NFTC stay under NFTC."," If a server runs an Oracle JDK 21 update that was released under NFTC, that binary didn't change licenses overnight on September 16.",[16,892,893,896],{},[20,894,895],{},"What changed is what happens next."," Oracle JDK 21 updates released after the cutoff, starting with the next quarterly Critical Patch Update, come under the OTN license. Applying one of those updates to a production system without a subscription is where the compliance exposure starts.",[16,898,899],{},"So the real question isn't \"is our Java 21 still free?\" It's this:",[901,902,903],"blockquote",{},[16,904,905],{},"Do we want to keep receiving security patches for Oracle JDK 21 in production?",[16,907,908],{},"If yes, you pay. If no, the runtime stops getting security fixes, and each quarter adds new published CVEs against it. There isn't a free way to keep patching Oracle JDK 21.",[11,910,912],{"id":911},"the-october-patch-is-the-trap","The October patch is the trap",[16,914,915],{},"Oracle and the OpenJDK community release Java security updates quarterly: January, April, July and October. The October 2026 Critical Patch Update is the first Oracle JDK 21 update outside the free window.",[16,917,918],{},"In most estates, nobody will make a conscious decision to accept OTN terms. It will happen through normal operations:",[35,920,921,924,927,930],{},[38,922,923],{},"A platform team applies the October CPU on schedule because that's their job.",[38,925,926],{},"A golden image or base container image picks up the latest Oracle JDK 21 in its next rebuild.",[38,928,929],{},"An installer, configuration-management role or package repository mirror pulls \"latest 21\" by default.",[38,931,932],{},"A vulnerability scanner flags the old build as outdated and someone raises a ticket to update it.",[16,934,935],{},"Each of these is good security hygiene, and each can move a system from free to licensable without anyone in procurement knowing. This is the same pattern many organizations saw with JDK 17 in late 2024.",[288,937,938],{},[16,939,940],{},"If your patch automation targets \"latest Oracle JDK 21\", check it before the October Critical Patch Update lands. Pin it, point it at an OpenJDK build, or make sure the subscription decision has been made first.",[11,942,944],{"id":943},"your-three-options","Your three options",[298,946,948],{"id":947},"_1-subscribe","1. Subscribe",[16,950,951],{},"You can buy the Oracle Java SE Universal Subscription and keep patching Oracle JDK 21. This is a legitimate choice, especially where an application vendor certifies only Oracle JDK, or where you want Oracle's support.",[16,953,954,955,227],{},"Know what you're buying: the subscription is priced per employee across the whole organization, not per install. A small Oracle JDK footprint can still produce a large bill. We explain how the metric works in ",[75,956,957],{"href":350},"how Oracle's employee-based Java metric works",[298,959,961],{"id":960},"_2-move-to-oracle-jdk-25-under-nftc","2. Move to Oracle JDK 25 under NFTC",[16,963,964],{},"JDK 25 is the current LTS and, at the time of writing, its updates are free under NFTC until roughly September 2028. Upgrading buys time.",[16,966,967],{},"It also means doing a major version upgrade, 21 to 25, which is a real engineering project, not a patch. The same cliff returns in about two years, when you'll need to decide again between paying, migrating and upgrading. Some teams are comfortable running that treadmill. Many decide it's cheaper to step off it once.",[298,969,971],{"id":970},"_3-migrate-to-an-openjdk-distribution","3. Migrate to an OpenJDK distribution",[16,973,974],{},"Oracle JDK is built from the OpenJDK source code. Several vendors ship free, TCK-tested OpenJDK builds with long-term security updates for JDK 21, and most also sell commercial support:",[35,976,977,980,983,986,989,992,995],{},[38,978,979],{},"Eclipse Temurin (Eclipse Adoptium)",[38,981,982],{},"Amazon Corretto",[38,984,985],{},"Azul Zulu",[38,987,988],{},"Red Hat build of OpenJDK",[38,990,991],{},"Microsoft Build of OpenJDK",[38,993,994],{},"BellSoft Liberica",[38,996,997],{},"IBM Semeru Runtimes (built on the Eclipse OpenJ9 VM instead of HotSpot, so it's a bigger change than the others)",[16,999,1000,1001,1004],{},"For most server workloads, moving from Oracle JDK 21 to another vendor's JDK 21 is a same-version swap. It's lower risk than a major version upgrade, but it isn't zero risk. Trust stores, installer layout, bundled tooling and some defaults differ between vendors. Our ",[75,1002,1003],{"href":356},"Oracle JDK to OpenJDK migration checklist"," covers what to verify.",[11,1006,1008],{"id":1007},"picking-between-them","Picking between them",[130,1010,1011,1026],{},[133,1012,1013],{},[136,1014,1015,1017,1020,1023],{},[139,1016],{},[139,1018,1019],{},"Subscribe",[139,1021,1022],{},"Upgrade to Oracle JDK 25",[139,1024,1025],{},"Migrate to OpenJDK 21",[152,1027,1028,1041,1055,1069,1081],{},[136,1029,1030,1033,1036,1039],{},[157,1031,1032],{},"Keeps patches flowing",[157,1034,1035],{},"Yes",[157,1037,1038],{},"Yes, until ~2028",[157,1040,1035],{},[136,1042,1043,1046,1049,1052],{},[157,1044,1045],{},"Engineering effort",[157,1047,1048],{},"Low",[157,1050,1051],{},"High (major upgrade)",[157,1053,1054],{},"Moderate (vendor swap)",[136,1056,1057,1060,1063,1066],{},[157,1058,1059],{},"Recurring license cost",[157,1061,1062],{},"Yes, per employee",[157,1064,1065],{},"None for now",[157,1067,1068],{},"None; optional support",[136,1070,1071,1074,1077,1079],{},[157,1072,1073],{},"Repeats in two years",[157,1075,1076],{},"No",[157,1078,1035],{},[157,1080,1076],{},[136,1082,1083,1086,1088,1091],{},[157,1084,1085],{},"Works for vendor apps certified only on Oracle",[157,1087,1035],{},[157,1089,1090],{},"Depends on vendor",[157,1092,1090],{},[16,1094,1095],{},"Most estates end up with a mix. A few applications stay on Oracle because a vendor requires it. Most move to OpenJDK. A handful of teams already planning a 25 upgrade just bring it forward.",[16,1097,1098],{},"You can't make that decision well without knowing where every Oracle JDK 21 install actually is, who owns it and what depends on it.",[11,1100,1102],{"id":1101},"what-to-do-this-quarter","What to do this quarter",[1104,1105,1106,1116,1122,1128,1138],"ol",{},[38,1107,1108,1111,1112,227],{},[20,1109,1110],{},"Find every Oracle JDK in the estate."," That includes the JDKs bundled inside vendor products, container images and build agents, not only the ones on your standard server builds. See ",[75,1113,1115],{"href":1114},"\u002Farticles\u002Ffinding-every-jvm-in-your-estate","finding every JVM in your estate",[38,1117,1118,1121],{},[20,1119,1120],{},"Freeze automatic updates to Oracle JDK 21"," until a decision is made, so the October CPU doesn't make the decision for you.",[38,1123,1124,1127],{},[20,1125,1126],{},"Split the inventory into three groups:"," migrate to OpenJDK, upgrade to 25, or keep on Oracle with a subscription. Record the reason for each keep.",[38,1129,1130,1133,1134,227],{},[20,1131,1132],{},"Move the easy majority first."," Same-version swaps on non-critical apps with good rollback can move quickly. See ",[75,1135,1137],{"href":1136},"\u002Farticles\u002Ffast-detection-and-rollback-instead-of-regression-testing","fast detection and rollback instead of regression testing",[38,1139,1140,1143],{},[20,1141,1142],{},"Keep evidence."," Record what was removed, when and where. If Oracle raises a licensing review later, dated evidence is what you'll want.",[84,1145,1146],{},[16,1147,1148],{},"This article describes Oracle's published licensing model as we understand it. It is not legal advice. Check your own contracts and Oracle's current license terms, and involve your licensing or legal team before relying on any conclusion.",[11,1150,1152],{"id":1151},"what-to-do-next","What to do next",[16,1154,1155,1156,1159,1160,1163],{},"If you don't have a current, trustworthy list of your Oracle JDK installs, start there. Our ",[75,1157,1158],{"href":253},"JVM discovery and estate assessment"," finds them, including the ones hidden inside other products. Our ",[75,1161,1162],{"href":225},"OpenJDK migration service"," moves them off Oracle on a fixed timeline.",{"title":229,"searchDepth":230,"depth":231,"links":1165},[1166,1167,1168,1169,1174,1175,1176],{"id":791,"depth":230,"text":792},{"id":880,"depth":230,"text":881},{"id":911,"depth":230,"text":912},{"id":943,"depth":230,"text":944,"children":1170},[1171,1172,1173],{"id":947,"depth":231,"text":948},{"id":960,"depth":231,"text":961},{"id":970,"depth":231,"text":971},{"id":1007,"depth":230,"text":1008},{"id":1101,"depth":230,"text":1102},{"id":1151,"depth":230,"text":1152},"2026-09-22","Oracle JDK 21 updates released after September 2026 are no longer free for production use. Your options: pay, stop patching, or migrate to OpenJDK.",false,null,{},{"title":779,"description":1178},"articles\u002Fjava-21-nftc-free-period-ended",[1185,1186,1187,1188,1189],"oracle-java","licensing","nftc","jdk-21","openjdk","fHHAvnXDhd_YKKkTYB5LNWhx8YgENz3um2D6bkxDjYE",{"id":1192,"title":1193,"author":780,"body":1194,"category":368,"date":1542,"description":1543,"draft":1179,"extension":241,"featured":1179,"image":1180,"meta":1544,"navigation":245,"path":350,"readingTime":682,"seo":1545,"stem":1546,"tags":1547,"updated":1180,"__hash__":1550},"articles\u002Farticles\u002Foracle-java-employee-metric-explained.md","How Oracle's employee-based Java metric works, and why a few installs can price your whole company",{"type":8,"value":1195,"toc":1532},[1196,1199,1209,1213,1216,1227,1230,1250,1262,1266,1277,1280,1357,1363,1367,1374,1385,1388,1396,1403,1406,1412,1416,1419,1422,1439,1449,1453,1456,1473,1476,1480,1483,1506,1509,1513,1516,1521,1523],[16,1197,1198],{},"Most software licenses scale with usage: more servers, more cores or more users means a bigger bill. Oracle's current Java SE subscription doesn't work that way, and that surprises a lot of finance and procurement teams the first time they see a quote.",[16,1200,1201,1202,1204,1205,1208],{},"Since January 2023, Oracle has sold Java SE commercially as the ",[20,1203,271],{},", priced on an ",[20,1206,1207],{},"employee"," metric. The count is based on the size of your organization, not on how much Java you run.",[11,1210,1212],{"id":1211},"what-counts-as-an-employee","What counts as an \"employee\"",[16,1214,1215],{},"Oracle's definition is broad. Paraphrasing the published terms, the employee count includes:",[35,1217,1218,1224],{},[38,1219,1220,1221],{},"all full-time, part-time and temporary employees of your organization, ",[20,1222,1223],{},"and",[38,1225,1226],{},"all full-time, part-time and temporary employees of your agents, contractors, outsourcers and consultants who support your internal business operations.",[16,1228,1229],{},"A few implications follow:",[35,1231,1232,1238,1244],{},[38,1233,1234,1237],{},[20,1235,1236],{},"It isn't limited to people who use Java."," Payroll, warehouse staff, sales and executives all count, whether or not they ever touch a Java application.",[38,1239,1240,1243],{},[20,1241,1242],{},"It isn't limited to where Java runs."," One business unit running Oracle JDK doesn't limit the count to that business unit.",[38,1245,1246,1249],{},[20,1247,1248],{},"Contractors and outsourcers can increase the number."," An outsourced service desk or a large offshore development partner may add materially to the total.",[16,1251,1252,1253,1256,1257,1261],{},"The number of installations, servers or processors doesn't enter the calculation. This is the core point: ",[20,1254,1255],{},"deployment footprint has almost no bearing on the price."," It mostly determines ",[1258,1259,1260],"em",{},"whether"," you need a subscription at all.",[11,1263,1265],{"id":1264},"the-published-price-bands","The published price bands",[16,1267,1268,1269,1272,1273,1276],{},"Oracle publishes list prices per employee per month, with volume bands. At the time of writing, the published list runs from ",[20,1270,1271],{},"$15 per employee per month"," in the smallest band down to ",[20,1274,1275],{},"$5.25"," in the largest published band. Organizations above the top band negotiate directly.",[16,1278,1279],{},"The bands as commonly cited from Oracle's price list:",[130,1281,1282,1292],{},[133,1283,1284],{},[136,1285,1286,1289],{},[139,1287,1288],{},"Total employees",[139,1290,1291],{},"List price per employee per month",[152,1293,1294,1302,1310,1318,1326,1334,1342,1349],{},[136,1295,1296,1299],{},[157,1297,1298],{},"1 – 999",[157,1300,1301],{},"$15.00",[136,1303,1304,1307],{},[157,1305,1306],{},"1,000 – 2,999",[157,1308,1309],{},"$12.00",[136,1311,1312,1315],{},[157,1313,1314],{},"3,000 – 9,999",[157,1316,1317],{},"$10.50",[136,1319,1320,1323],{},[157,1321,1322],{},"10,000 – 19,999",[157,1324,1325],{},"$8.25",[136,1327,1328,1331],{},[157,1329,1330],{},"20,000 – 29,999",[157,1332,1333],{},"$6.75",[136,1335,1336,1339],{},[157,1337,1338],{},"30,000 – 39,999",[157,1340,1341],{},"$5.70",[136,1343,1344,1347],{},[157,1345,1346],{},"40,000 – 49,999",[157,1348,1275],{},[136,1350,1351,1354],{},[157,1352,1353],{},"50,000+",[157,1355,1356],{},"Negotiated",[1358,1359,1360],"caution",{},[16,1361,1362],{},"List prices change and discounts vary. Always check Oracle's current Java SE price list and your own contract terms. Treat the figures here as a way to estimate the order of magnitude, not a quote.",[11,1364,1366],{"id":1365},"a-worked-example","A worked example",[16,1368,1369,1370,1373],{},"Here's an ",[20,1371,1372],{},"illustrative"," organization, not a real client:",[35,1375,1376,1379,1382],{},[38,1377,1378],{},"5,000 employees, including in-scope contractors",[38,1380,1381],{},"Oracle JDK installed on 40 servers, running a handful of internal applications",[38,1383,1384],{},"No other Oracle Java use",[16,1386,1387],{},"At the 3,000–9,999 band list price of $10.50 per employee per month:",[901,1389,1390],{},[16,1391,1392,1393],{},"5,000 employees × $10.50 × 12 months = ",[20,1394,1395],{},"$630,000 per year",[16,1397,1398,1399,1402],{},"That's roughly ",[20,1400,1401],{},"$15,750 per server per year"," for 40 servers, for a runtime that has free, drop-in-compatible alternatives.",[16,1404,1405],{},"Now suppose those 40 servers turn out to be 38 that can move to a free OpenJDK build and 2 running a vendor product certified only on Oracle JDK. The subscription price doesn't drop by 95%. It stays the same, because the metric is headcount. Removing Oracle JDK from 38 servers doesn't reduce the bill. Removing it from all 40 eliminates the bill.",[16,1407,1408,1409,227],{},"This is why the employee metric makes licensing an ",[20,1410,1411],{},"all-or-nothing inventory problem",[11,1413,1415],{"id":1414},"why-inventory-accuracy-is-the-lever","Why inventory accuracy is the lever",[16,1417,1418],{},"Under per-processor licensing, a slightly incomplete inventory meant a slightly wrong number. Under the employee metric, one forgotten install can carry the full cost.",[16,1420,1421],{},"The Oracle JDKs that cause problems are rarely on the standard server build. They tend to be:",[35,1423,1424,1427,1430,1433,1436],{},[38,1425,1426],{},"Old Oracle JDK 8 installs on long-lived servers that nobody has rebuilt",[38,1428,1429],{},"Oracle JDKs bundled into, or manually added to, vendor products and appliances",[38,1431,1432],{},"Developer tooling and build agents that fetched \"the Oracle JDK\" years ago",[38,1434,1435],{},"Base container images that were never updated",[38,1437,1438],{},"Desktop installs for a single legacy client application",[16,1440,1441,1442,1444,1445,227],{},"Finding them takes more than querying the package manager on your standard Linux build. We describe what a complete discovery looks like in ",[75,1443,1115],{"href":1114},", and the harder case of ",[75,1446,1448],{"href":1447},"\u002Farticles\u002Fpatching-jvms-inside-vendor-products","JVMs bundled inside vendor products",[11,1450,1452],{"id":1451},"not-every-oracle-jdk-is-automatically-in-scope","Not every Oracle JDK is automatically in scope",[16,1454,1455],{},"Two nuances are worth checking before assuming exposure:",[35,1457,1458,1467],{},[38,1459,1460,1463,1464,227],{},[20,1461,1462],{},"Builds released under the No-Fee Terms and Conditions (NFTC) license."," Oracle JDK 17 and later have been released under NFTC for a limited period per release. A binary released under NFTC isn't necessarily a licensing problem on its own; updates released after the free window are. See ",[75,1465,1466],{"href":284},"what the end of the JDK 21 free window means",[38,1468,1469,1472],{},[20,1470,1471],{},"Java included with another licensed product."," Some Oracle and third-party products include a restricted Java SE license for use with that product only. That usually doesn't cover general-purpose use of the same JDK by other applications on the same host.",[16,1474,1475],{},"Both depend on specific versions, dates and contract wording. That's exactly why the inventory needs to record version, vendor, build and what each JVM is used for, not just \"Java is installed here.\"",[11,1477,1479],{"id":1478},"making-a-deliberate-decision","Making a deliberate decision",[16,1481,1482],{},"Once you know where every Oracle JDK is, the decision gets much clearer. For each install, choose one:",[1104,1484,1485,1494,1500],{},[38,1486,1487,1490,1491,227],{},[20,1488,1489],{},"Migrate"," to a free OpenJDK build such as Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat build of OpenJDK or Microsoft Build of OpenJDK. See our ",[75,1492,1493],{"href":356},"migration checklist",[38,1495,1496,1499],{},[20,1497,1498],{},"Remove"," it if nothing actually uses it. This is more common than you'd expect.",[38,1501,1502,1505],{},[20,1503,1504],{},"Keep"," it, deliberately, because a vendor requires it or Oracle support is worth the cost to you. If the answer for even one install is \"keep,\" price the subscription on your full employee count and decide knowingly.",[16,1507,1508],{},"What you want to avoid is the default outcome, where the subscription cost is set by an install nobody remembered.",[11,1510,1512],{"id":1511},"a-note-on-audits-and-renewals","A note on audits and renewals",[16,1514,1515],{},"Oracle doesn't publish audit statistics. Licensing advisors report a steady volume of Java-related compliance conversations since the metric change. Whether a conversation starts from an audit, a renewal or an inbound sales call, the party with the accurate inventory negotiates from a much stronger position.",[84,1517,1518],{},[16,1519,1520],{},"This article explains Oracle's published Java SE licensing model as we understand it. It is not legal advice. Check your contracts, Oracle's current terms and price list, and involve your licensing and legal teams before making commitments.",[11,1522,1152],{"id":1151},[16,1524,1525,1526,1528,1529,1531],{},"Start with the facts. Our ",[75,1527,1158],{"href":253}," quantifies your Oracle Java exposure against the employee metric, and our ",[75,1530,1162],{"href":225}," removes the installs that don't need to be there.",{"title":229,"searchDepth":230,"depth":231,"links":1533},[1534,1535,1536,1537,1538,1539,1540,1541],{"id":1211,"depth":230,"text":1212},{"id":1264,"depth":230,"text":1265},{"id":1365,"depth":230,"text":1366},{"id":1414,"depth":230,"text":1415},{"id":1451,"depth":230,"text":1452},{"id":1478,"depth":230,"text":1479},{"id":1511,"depth":230,"text":1512},{"id":1151,"depth":230,"text":1152},"2026-09-15","Oracle's Java SE Universal Subscription is priced per employee, not per install. How the metric works, a worked example, and why your inventory drives the cost.",{},{"title":1193,"description":1543},"articles\u002Foracle-java-employee-metric-explained",[1185,1186,1548,1549],"java-se-subscription","cost","1jkg2uxHIWgnHabam8v1YiZLTRXXmSpnRSmbEqmkF3Y",{"id":1552,"title":1553,"author":780,"body":1554,"category":2026,"date":2027,"description":2028,"draft":1179,"extension":241,"featured":1179,"image":1180,"meta":2029,"navigation":245,"path":356,"readingTime":767,"seo":2030,"stem":2031,"tags":2032,"updated":1180,"__hash__":2037},"articles\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist.md","Oracle JDK to OpenJDK: a practical migration checklist",{"type":8,"value":1555,"toc":2009},[1556,1563,1566,1569,1573,1576,1593,1598,1602,1605,1694,1697,1735,1739,1742,1746,1760,1764,1784,1788,1808,1812,1844,1848,1853,1857,1868,1872,1875,1895,1904,1908,1914,1940,1944,1950,1954,1998,2000],[16,1557,1558,1559,1562],{},"For most server workloads, moving from Oracle JDK to an OpenJDK distribution of the ",[20,1560,1561],{},"same version"," is one of the lowest-risk changes you can make to a Java runtime. Oracle JDK and the major OpenJDK builds come from the same source code, and the reputable distributions are tested against the Java SE Technology Compatibility Kit (TCK).",[16,1564,1565],{},"\"Low risk\" isn't \"no risk,\" though. The failures we see in vendor swaps are rarely about Java language behavior. They come from what surrounds the runtime: trust stores, install paths, startup flags, bundled components and applications that look for Oracle specifically.",[16,1567,1568],{},"This checklist is what we work through on every migration.",[11,1570,1572],{"id":1571},"step-0-know-what-youre-migrating","Step 0: Know what you're migrating",[16,1574,1575],{},"You can't migrate what you haven't found. Before you pick a distribution, you need a list of every Oracle JDK and JRE with:",[35,1577,1578,1581,1584,1587,1590],{},[38,1579,1580],{},"host, container image or artifact where it lives",[38,1582,1583],{},"version and exact build",[38,1585,1586],{},"whether it's standalone, used by an app server, or bundled inside a vendor product",[38,1588,1589],{},"the application and owner that depend on it",[38,1591,1592],{},"how it gets there (golden image, config management, manual install, vendor installer)",[16,1594,1595,1596,227],{},"That last field matters more than people expect. If you migrate a server but the golden image still installs Oracle JDK, it comes back on the next rebuild. See ",[75,1597,1115],{"href":1114},[11,1599,1601],{"id":1600},"step-1-choose-a-distribution","Step 1: Choose a distribution",[16,1603,1604],{},"Several vendors publish free, production-ready OpenJDK builds. Most also offer paid support. The main ones:",[130,1606,1607,1620],{},[133,1608,1609],{},[136,1610,1611,1614,1617],{},[139,1612,1613],{},"Distribution",[139,1615,1616],{},"Maintainer",[139,1618,1619],{},"Notes",[152,1621,1622,1633,1643,1653,1663,1673,1683],{},[136,1623,1624,1627,1630],{},[157,1625,1626],{},"Eclipse Temurin",[157,1628,1629],{},"Eclipse Adoptium",[157,1631,1632],{},"Widely used vendor-neutral default; commercial support available from third parties",[136,1634,1635,1637,1640],{},[157,1636,982],{},[157,1638,1639],{},"Amazon",[157,1641,1642],{},"Free; used heavily inside AWS",[136,1644,1645,1647,1650],{},[157,1646,985],{},[157,1648,1649],{},"Azul",[157,1651,1652],{},"Free builds; broad platform and older-version coverage; paid support available",[136,1654,1655,1657,1660],{},[157,1656,988],{},[157,1658,1659],{},"Red Hat",[157,1661,1662],{},"Natural fit for RHEL estates; supported through Red Hat subscriptions",[136,1664,1665,1667,1670],{},[157,1666,991],{},[157,1668,1669],{},"Microsoft",[157,1671,1672],{},"Covers recent LTS releases (11 onward); used across Azure",[136,1674,1675,1677,1680],{},[157,1676,994],{},[157,1678,1679],{},"BellSoft",[157,1681,1682],{},"Offers \"full\" builds that include JavaFX",[136,1684,1685,1688,1691],{},[157,1686,1687],{},"IBM Semeru Runtimes",[157,1689,1690],{},"IBM",[157,1692,1693],{},"Uses the Eclipse OpenJ9 VM, not HotSpot, so a bigger behavioral change",[16,1695,1696],{},"The criteria that actually matter:",[35,1698,1699,1705,1711,1717,1723,1729],{},[38,1700,1701,1704],{},[20,1702,1703],{},"LTS support length."," How long will this vendor ship security updates for the versions you run? Check the vendor's published roadmap for each version you need, especially Java 8 and 11.",[38,1706,1707,1710],{},[20,1708,1709],{},"Update cadence."," Updates should follow the quarterly Critical Patch Update schedule (January, April, July, October), released promptly after each one.",[38,1712,1713,1716],{},[20,1714,1715],{},"Commercial support."," Do you need a contract and an SLA for production incidents? Some distributions sell support directly; for others it's available from third parties.",[38,1718,1719,1722],{},[20,1720,1721],{},"Platform coverage."," Operating systems, CPU architectures (x86-64, ARM64), container base images, and installers for Windows if you have Windows servers or desktops.",[38,1724,1725,1728],{},[20,1726,1727],{},"TCK certification."," Confirm the builds you'll use are TCK-tested for the versions you need.",[38,1730,1731,1734],{},[20,1732,1733],{},"Standardization."," One distribution across the estate is usually easier to patch, scan and support than several. Pick one default and allow exceptions only with a reason.",[11,1736,1738],{"id":1737},"step-2-check-the-known-differences","Step 2: Check the known differences",[16,1740,1741],{},"These are the areas where vendor swaps actually cause problems.",[298,1743,1745],{"id":1744},"removed-or-unbundled-components-mostly-java-8","Removed or unbundled components (mostly Java 8)",[35,1747,1748,1754],{},[38,1749,1750,1753],{},[20,1751,1752],{},"JavaFX."," Oracle JDK 8 bundled JavaFX. Most OpenJDK 8 builds don't. Applications with JavaFX user interfaces need a build that includes it (some vendors offer these) or a separate OpenJFX dependency.",[38,1755,1756,1759],{},[20,1757,1758],{},"Java Web Start and the browser plugin."," These were part of Oracle JDK 8 but were never in OpenJDK, and were removed from Oracle JDK in 11. Applications launched via JNLP need an alternative launcher such as OpenWebStart, or a different delivery method.",[298,1761,1763],{"id":1762},"startup-flags","Startup flags",[35,1765,1766,1778],{},[38,1767,1768,1773,1774,1777],{},[20,1769,1770,227],{},[331,1771,1772],{},"-XX:+UnlockCommercialFeatures"," Older Oracle JDK 8 builds needed this flag to enable Java Flight Recorder, which was a commercial feature at the time. Startup scripts that still pass it may fail with an unrecognized-option error on other runtimes, which means the JVM ",[20,1775,1776],{},"doesn't start",". Search every start script, service unit, container entrypoint and app-server config for commercial and Oracle-specific flags.",[38,1779,1780,1783],{},[20,1781,1782],{},"Deprecated or obsolete flags"," in general. If the migration also changes the build level, check the startup options against the target version's documentation.",[298,1785,1787],{"id":1786},"trust-stores","Trust stores",[35,1789,1790,1799],{},[38,1791,1792,1798],{},[20,1793,1794,1797],{},[331,1795,1796],{},"cacerts"," contents differ between vendors."," Each distribution curates its own default set of trusted root CAs. If an application connects to a partner or internal service whose certificate chains to a root that's in Oracle's store but not your new vendor's, TLS handshakes will fail.",[38,1800,1801,1804,1805,1807],{},[20,1802,1803],{},"Custom certificates added by hand"," to the old JDK's ",[331,1806,1796],{}," will not be carried over. Inventory them and re-import them, or better, move to a managed trust store outside the JDK directory.",[298,1809,1811],{"id":1810},"paths-installers-and-registry-keys","Paths, installers and registry keys",[35,1813,1814,1822,1831],{},[38,1815,1816,1821],{},[20,1817,1818,1820],{},[331,1819,333],{}," and hard-coded paths."," Scripts and service definitions often point at paths like an Oracle-specific install directory. Find them before you uninstall anything.",[38,1823,1824,1827,1828,1830],{},[20,1825,1826],{},"Windows registry keys."," Some applications find Java through Oracle's registry entries instead of ",[331,1829,333],{},". Check whether your chosen distribution's installer can set compatible keys, and test the applications that depend on them.",[38,1832,1833,1836,1837,1839,1840,1843],{},[20,1834,1835],{},"Alternatives and symlinks"," on Linux. Make sure ",[331,1838,621],{}," on the ",[331,1841,1842],{},"PATH"," resolves to the runtime you think it does.",[298,1845,1847],{"id":1846},"rendering-and-fonts","Rendering and fonts",[35,1849,1850],{},[38,1851,1852],{},"Older Oracle JDK 8 builds used a different font rasterizer from OpenJDK builds, so reports, PDF generation and desktop UIs can render text slightly differently. This rarely matters for services, but it can for document-generation workloads.",[298,1854,1856],{"id":1855},"vendor-certification","Vendor certification",[35,1858,1859],{},[38,1860,1861,1864,1865,227],{},[20,1862,1863],{},"Third-party products that certify only Oracle JDK."," Some commercial applications list only Oracle JDK in their support matrix. Running them on another build may be technically fine and still unsupported. Ask the vendor, get the answer in writing, and record it. See ",[75,1866,1867],{"href":1447},"patching JVMs inside vendor products",[11,1869,1871],{"id":1870},"step-3-verify-then-roll-out-progressively","Step 3: Verify, then roll out progressively",[16,1873,1874],{},"For a same-version vendor swap on a non-critical application, you usually don't need a full regression cycle. You do need:",[1104,1876,1877,1883,1889],{},[38,1878,1879,1882],{},[20,1880,1881],{},"Smoke tests"," covering startup, the main user paths, outbound TLS connections and scheduled jobs.",[38,1884,1885,1888],{},[20,1886,1887],{},"A canary."," Move one instance or a small share of traffic first, and compare error rates, latency, GC behavior and log noise with the old runtime.",[38,1890,1891,1894],{},[20,1892,1893],{},"A tested rollback."," Keep the previous runtime available until the new one has been stable for an agreed period, and know exactly how to switch back.",[16,1896,1897,1898,1900,1901,227],{},"For business-critical systems, add shadow-traffic comparison or targeted regression tests on the paths most exposed to runtime differences. We describe the thinking in ",[75,1899,1137],{"href":1136}," and the common failure patterns in ",[75,1902,1903],{"href":462},"how JVM patches break production",[11,1905,1907],{"id":1906},"step-4-remove-oracle-dont-just-re-point","Step 4: Remove Oracle, don't just re-point",[16,1909,1910,1911,1913],{},"This is where many migrations stop short. Changing ",[331,1912,333],{}," to the new runtime leaves the Oracle binaries on disk, and from a licensing point of view an installed Oracle JDK is still an Oracle JDK.",[35,1915,1916,1922,1928,1934],{},[38,1917,1918,1921],{},[20,1919,1920],{},"Uninstall"," Oracle JDK and JRE packages, and delete leftover directories.",[38,1923,1924,1927],{},[20,1925,1926],{},"Update the sources",": golden images, container base images, configuration-management roles, internal package mirrors and software catalogs.",[38,1929,1930,1933],{},[20,1931,1932],{},"Block reintroduction."," Add a check in image builds or CI that fails if an Oracle JDK appears.",[38,1935,1936,1939],{},[20,1937,1938],{},"Re-scan"," after cleanup to confirm nothing remains.",[11,1941,1943],{"id":1942},"step-5-keep-the-evidence","Step 5: Keep the evidence",[16,1945,1946,1947,227],{},"Record what was migrated or removed, where, when and by whom, with before-and-after scan output. If a licensing review happens later, dated evidence of removal is far more persuasive than a statement that \"we moved off Oracle last year.\" This matters especially given ",[75,1948,1949],{"href":350},"how Oracle's employee-based metric works",[11,1951,1953],{"id":1952},"the-checklist","The checklist",[1104,1955,1956,1959,1962,1965,1968,1974,1977,1983,1986,1989,1992,1995],{},[38,1957,1958],{},"Build a complete inventory of Oracle JDK and JRE installs, including bundled and containerized ones.",[38,1960,1961],{},"Record the owner, the dependent applications and how each install gets provisioned.",[38,1963,1964],{},"Choose a default OpenJDK distribution and document the exceptions policy.",[38,1966,1967],{},"Flag JavaFX, Java Web Start and other Oracle-8-only dependencies.",[38,1969,1970,1971,1973],{},"Search startup configuration for ",[331,1972,1772],{}," and other Oracle-specific or obsolete flags.",[38,1975,1976],{},"Compare trust stores and re-import custom certificates.",[38,1978,1979,1980,1982],{},"Find hard-coded paths, ",[331,1981,333],{}," settings and registry dependencies.",[38,1984,1985],{},"Confirm vendor support for third-party products, in writing.",[38,1987,1988],{},"Smoke test, canary and keep a rehearsed rollback.",[38,1990,1991],{},"Uninstall Oracle binaries and fix the golden images and automation that installed them.",[38,1993,1994],{},"Re-scan to confirm removal.",[38,1996,1997],{},"Archive the evidence.",[11,1999,1152],{"id":1151},[16,2001,2002,2003,2005,2006,2008],{},"If you want this done on a fixed timeline, our ",[75,2004,1162],{"href":225}," runs the whole checklist, starting from a ",[75,2007,1158],{"href":253}," so nothing gets missed.",{"title":229,"searchDepth":230,"depth":231,"links":2010},[2011,2012,2013,2021,2022,2023,2024,2025],{"id":1571,"depth":230,"text":1572},{"id":1600,"depth":230,"text":1601},{"id":1737,"depth":230,"text":1738,"children":2014},[2015,2016,2017,2018,2019,2020],{"id":1744,"depth":231,"text":1745},{"id":1762,"depth":231,"text":1763},{"id":1786,"depth":231,"text":1787},{"id":1810,"depth":231,"text":1811},{"id":1846,"depth":231,"text":1847},{"id":1855,"depth":231,"text":1856},{"id":1870,"depth":230,"text":1871},{"id":1906,"depth":230,"text":1907},{"id":1942,"depth":230,"text":1943},{"id":1952,"depth":230,"text":1953},{"id":1151,"depth":230,"text":1152},"openjdk-migration","2026-09-08","A step-by-step checklist for moving from Oracle JDK to an OpenJDK build: choosing a distribution, what differs between vendors, verification and cleanup.",{},{"title":1553,"description":2028},"articles\u002Foracle-jdk-to-openjdk-migration-checklist",[1189,1185,2033,2034,2035,2036],"migration","temurin","corretto","zulu","3wYnAM2s__rsMjzNJvmeHU4vhiOOa4RHGxad2U61D08",1790355849638]