[{"data":1,"prerenderedAt":1309},["ShallowReactive",2],{"services":3,"article-\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist":776,"author-patchmageddon-team":1283,"related-\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist":1299,"article-surround-\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist":1300},[4,257,383,502,603,693],{"id":5,"title":6,"body":7,"category":238,"description":239,"engagement":240,"extension":241,"headline":242,"icon":243,"meta":244,"navigation":245,"order":246,"outcomes":247,"path":253,"seo":254,"stem":255,"__hash__":256},"services\u002Fservices\u002Fjvm-discovery.md","JVM Discovery & Estate Assessment",{"type":8,"value":9,"toc":228},"minimark",[10,15,24,27,31,34,79,83,93,125,129,206,210],[11,12,14],"h2",{"id":13},"the-problem","The problem",[16,17,18,19,23],"p",{},"Most enterprises can't produce an accurate, current list of the Java runtimes they run. The CMDB records some. Config management records others. The rest are ",[20,21,22],"strong",{},"shadow JVMs",": runtimes bundled inside vendor products, application servers, CI\u002FCD agents, monitoring tools, desktop software and container images that nobody thinks of as \"Java\".",[16,25,26],{},"Shadow JVMs are the ones that miss every patch cycle. For Oracle Java, they are also the installs that can put your entire headcount in scope for a subscription.",[11,28,30],{"id":29},"what-we-find","What we find",[16,32,33],{},"For every JVM across dev, staging and production we capture:",[35,36,37,44,50,56,62,68],"ul",{},[38,39,40,43],"li",{},[20,41,42],{},"Version, vendor and patch level",": Oracle JDK, Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat, Microsoft, IBM Semeru and others",[38,45,46,49],{},[20,47,48],{},"Where it is embedded",": standalone apps, Tomcat, WebLogic, WebSphere, JBoss\u002FWildFly, vendor products, containers",[38,51,52,55],{},[20,53,54],{},"CVE exposure",", mapped to each version and scored so the worst exposure rises to the top",[38,57,58,61],{},[20,59,60],{},"Installed agents",": APM, security and profiling agents, which cause many patch failures",[38,63,64,67],{},[20,65,66],{},"Ownership",": who actually runs each application. This is often the hardest part to get right.",[38,69,70,73,74],{},[20,71,72],{},"Criticality signals"," that feed ",[75,76,78],"a",{"href":77},"\u002Fapproach#classification","application classification",[11,80,82],{"id":81},"how-we-do-it","How we do it",[84,85,86],"note",{},[16,87,88,89,92],{},"Discovery is ",[20,90,91],{},"read-only",". Nothing is patched, restarted or deployed, so the engagement doesn't need change-control approval, and the access we ask for is kept to a minimum.",[35,94,95,101,107,113,119],{},[38,96,97,100],{},[20,98,99],{},"Agentless scanning"," over SSH and WinRM (process listings and filesystem inspection) where possible",[38,102,103,106],{},[20,104,105],{},"Reconciliation against your CMDB and config management"," (Ansible, Puppet, Chef). The drift between what is recorded and what is running is a finding in its own right.",[38,108,109,112],{},[20,110,111],{},"Cloud provider APIs"," (AWS, Azure, GCP) for instance and container metadata",[38,114,115,118],{},[20,116,117],{},"Container image and artifact repository scanning"," (registries, Nexus, Artifactory) to catch JVMs before they are even running",[38,120,121,124],{},[20,122,123],{},"Reuse of the scanners you already own",". Tenable, Qualys, Snyk and JFrog Xray already collect useful data. We add the JVM-specific interpretation and a remediation plan; we don't sell you another scanner.",[11,126,128],{"id":127},"three-ways-to-engage","Three ways to engage",[130,131,132,151],"table",{},[133,134,135],"thead",{},[136,137,138,142,145,148],"tr",{},[139,140,141],"th",{},"Package",[139,143,144],{},"Scope",[139,146,147],{},"Turnaround",[139,149,150],{},"Purpose",[152,153,154,171,187],"tbody",{},[136,155,156,162,165,168],{},[157,158,159],"td",{},[20,160,161],{},"Quick Scan",[157,163,164],{},"One business unit or subset of the estate",[157,166,167],{},"Days",[157,169,170],{},"Prove what a full assessment will find",[136,172,173,178,181,184],{},[157,174,175],{},[20,176,177],{},"Full Estate Assessment",[157,179,180],{},"The whole estate",[157,182,183],{},"2–4 weeks",[157,185,186],{},"Complete inventory, risk report and remediation plan",[136,188,189,197,200,203],{},[157,190,191],{},[20,192,193],{},[75,194,196],{"href":195},"\u002Fservices\u002Fdrift-monitoring","Continuous Drift Monitoring",[157,198,199],{},"Ongoing",[157,201,202],{},"Subscription",[157,204,205],{},"Keep the inventory, risk and license picture current",[11,207,209],{"id":208},"what-you-walk-away-with","What you walk away with",[16,211,212,213,217,218,222,223,227],{},"The executive summary puts the findings in business terms: unbudgeted license exposure, days of exposure on unpatched critical CVEs, and the percentage of the estate on end-of-life versions. It ends with a direct recommendation of which applications belong in ",[75,214,216],{"href":215},"\u002Fservices\u002Frapid-patch","Rapid Patch",", which need ",[75,219,221],{"href":220},"\u002Fservices\u002Fcritical-patch-assurance","Critical Patch Assurance",", and which Oracle installs to ",[75,224,226],{"href":225},"\u002Fservices\u002Fopenjdk-migration","migrate or keep",".",{"title":229,"searchDepth":230,"depth":231,"links":232},"",2,3,[233,234,235,236,237],{"id":13,"depth":230,"text":14},{"id":29,"depth":230,"text":30},{"id":81,"depth":230,"text":82},{"id":127,"depth":230,"text":128},{"id":208,"depth":230,"text":209},"jvm-discovery","Find every JVM in your estate, including the ones bundled inside vendor products and containers, and turn the findings into a prioritized, costed remediation plan.","Read-only and fixed-price. A Quick Scan of one business unit takes days; a Full Estate Assessment takes two to four weeks. Nothing changes in production, so no CAB approval is needed.","md","Start here","i-lucide-radar",{},true,1,[248,249,250,251,252],"A complete inventory of every JVM, with version, vendor, patch level and location","CVE exposure scored per JVM, not a raw vulnerability count","Oracle Java license exposure quantified in dollars","Owners mapped for each application","An executive summary with a prioritized remediation plan","\u002Fservices\u002Fjvm-discovery",{"title":6,"description":239},"services\u002Fjvm-discovery","xwCt4w5iuENInyc5KpzKLmV4sk8GzNe5e1H4Q9b7mV8",{"id":258,"title":259,"body":260,"category":368,"description":369,"engagement":370,"extension":241,"headline":371,"icon":372,"meta":373,"navigation":245,"order":230,"outcomes":374,"path":225,"seo":380,"stem":381,"__hash__":382},"services\u002Fservices\u002Fopenjdk-migration.md","Oracle Java Licensing & OpenJDK Migration",{"type":8,"value":261,"toc":358},[262,266,273,279,287,293,297,302,309,313,316,320,323,327,335,339],[11,263,265],{"id":264},"why-this-is-urgent","Why this is urgent",[16,267,268,269,272],{},"Since January 2023, Oracle has sold Java SE through the ",[20,270,271],{},"Java SE Universal Subscription",", which is priced per employee rather than per installation. The count covers full-time, part-time and temporary staff, plus contractors who support internal operations, however few machines actually run Oracle Java.",[16,274,275,276,227],{},"So a handful of forgotten Oracle JDK installs can put your whole headcount in scope. For example, an organization of 5,000 employees running Oracle Java on 40 servers can face a list-price bill of around ",[20,277,278],{},"$630,000 a year",[16,280,281,282,286],{},"The free window is closing too. Oracle's No-Fee Terms and Conditions (NFTC) cover each LTS release only until one year after the next LTS ships. For Oracle JDK 21, that window ",[75,283,285],{"href":284},"\u002Farticles\u002Fjava-21-nftc-free-period-ended","closed on September 16, 2026",". Continuing to patch it now requires a paid subscription.",[288,289,290],"warning",{},[16,291,292],{},"We are not lawyers, and nothing here is legal advice. Licensing terms and prices change; check them against Oracle's current price list and your own agreements. Where a formal licensing position is needed, we work alongside independent licensing specialists.",[11,294,296],{"id":295},"what-we-do","What we do",[298,299,301],"h3",{"id":300},"_1-quantify-the-exposure","1. Quantify the exposure",[16,303,304,305,308],{},"Using the ",[75,306,307],{"href":253},"discovery inventory",", we identify every Oracle JDK and JRE, how it got there, and whether it is covered by another product's license. Then we put a number on what it costs you.",[298,310,312],{"id":311},"_2-decide-install-by-install","2. Decide, install by install",[16,314,315],{},"Most Oracle installs have no reason to be Oracle. A few do: vendor certification requirements or specific support needs. We make that call explicitly for each install instead of by default.",[298,317,319],{"id":318},"_3-migrate","3. Migrate",[16,321,322],{},"OpenJDK builds from Eclipse Adoptium (Temurin), Amazon (Corretto), Azul (Zulu), Red Hat and Microsoft are TCK-tested and free to use in production. For same-version swaps, migration is usually low risk, but not zero risk. We check for the known differences: truststore contents, installer paths and registry keys, fonts, and old commercial-feature flags. Then we roll out progressively.",[298,324,326],{"id":325},"_4-prove-it","4. Prove it",[16,328,329,330,334],{},"Uninstalling is not the same as re-pointing ",[331,332,333],"code",{},"JAVA_HOME",". We verify that Oracle binaries are actually gone and keep the evidence, which you will want if Oracle ever asks.",[11,336,338],{"id":337},"further-reading","Further reading",[35,340,341,346,352],{},[38,342,343],{},[75,344,345],{"href":284},"Oracle JDK 21's free update window has closed",[38,347,348],{},[75,349,351],{"href":350},"\u002Farticles\u002Foracle-java-employee-metric-explained","Oracle's employee-based Java pricing, explained",[38,353,354],{},[75,355,357],{"href":356},"\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist","An Oracle JDK to OpenJDK migration checklist",{"title":229,"searchDepth":230,"depth":231,"links":359},[360,361,367],{"id":264,"depth":230,"text":265},{"id":295,"depth":230,"text":296,"children":362},[363,364,365,366],{"id":300,"depth":231,"text":301},{"id":311,"depth":231,"text":312},{"id":318,"depth":231,"text":319},{"id":325,"depth":231,"text":326},{"id":337,"depth":230,"text":338},"oracle-licensing","Quantify your Oracle Java SE exposure, then move every install that doesn't need Oracle onto a free, drop-in OpenJDK build, with evidence you can take to an audit or renewal.","Fixed-scope. We start from the discovery inventory, size your exposure, then migrate in waves. Low-criticality apps go first via Rapid Patch.","Often pays for itself","i-lucide-arrow-right-left",{},[375,376,377,378,379],"Your Oracle Java license exposure, in dollars, with the installs that drive it","A keep-or-migrate decision for every Oracle JDK install","Migration to Temurin, Corretto, Zulu, Red Hat or Microsoft builds of OpenJDK","Verified removal of Oracle binaries, with an evidence trail","Data to negotiate from ahead of an audit or renewal",{"title":259,"description":369},"services\u002Fopenjdk-migration","0aWf4Vd_7P0phaKwOWxq3bLjO4iX8gdRjDu_tPGAWBY",{"id":384,"title":216,"body":385,"category":488,"description":489,"engagement":490,"extension":241,"headline":491,"icon":492,"meta":493,"navigation":245,"order":231,"outcomes":494,"path":215,"seo":499,"stem":500,"__hash__":501},"services\u002Fservices\u002Frapid-patch.md",{"type":8,"value":386,"toc":482},[387,391,394,401,405,412,424,428,465,471,475],[11,388,390],{"id":389},"the-premise","The premise",[16,392,393],{},"Full regression testing before every JVM security patch is the main reason enterprise patch cycles take months. For business-critical systems that rigor is warranted. For the long tail of internal tools, batch jobs and low-traffic services it usually isn't. There it just delays the fix for a known CVE.",[16,395,396,397,400],{},"Rapid Patch ",[20,398,399],{},"does not skip testing",". It replaces pre-deployment regression testing with fast detection and fast rollback. If a bad patch is caught in minutes and reversed in minutes, running without an exhaustive test suite costs very little.",[11,402,404],{"id":403},"who-its-for","Who it's for",[16,406,407,408,411],{},"Applications that score below the critical threshold in our ",[75,409,410],{"href":77},"classification process",". This is a documented, weighted score with a named risk-acceptor, not an app owner's self-assessment. Apps near the threshold go to manual review.",[16,413,414,415,418,419,423],{},"Rapid Patch covers ",[20,416,417],{},"same-major security patches"," (for example 17.0.x to the next 17.0.x). Major version upgrades and vendor swaps are ",[75,420,422],{"href":421},"\u002Fapproach#patch-types","different engagements"," with a different risk profile.",[11,425,427],{"id":426},"how-it-works","How it works",[35,429,430,436,442,448,454],{},[38,431,432,435],{},[20,433,434],{},"Progressive rollout",": canary at 1%, then 10%, then 100%, gated on automated health checks",[38,437,438,441],{},[20,439,440],{},"Observability as the safety net",": error rates, latency, GC pause times, heap and thread behavior compared before and after the patch",[38,443,444,447],{},[20,445,446],{},"Fast, rehearsed rollback",": the previous runtime stays in place until the soak period ends, and rollback is exercised, not just written down",[38,449,450,453],{},[20,451,452],{},"Smoke tests and synthetic transactions"," for the paths that matter, in place of a full regression suite",[38,455,456,459,460,464],{},[20,457,458],{},"A pre-flight check"," for ",[75,461,463],{"href":462},"\u002Farticles\u002Fjvm-patch-failure-modes","known failure modes",": APM agents, TLS defaults, GC flags",[466,467,468],"tip",{},[16,469,470],{},"In many non-containerized estates, reliable rollback is the real gap. When that's the case we fix it first, because that step alone makes the patch cycle faster.",[11,472,474],{"id":473},"governance","Governance",[16,476,477,478],{},"Your Change Advisory Board approves the process once, as a standard change for a defined tier, instead of approving each patch. Every rollout produces evidence: which signals were checked, the results, timestamps, and who accepted the risk. ",[75,479,481],{"href":480},"\u002Farticles\u002Fcab-approval-for-faster-jvm-patching","How we get this past a CAB →",{"title":229,"searchDepth":230,"depth":231,"links":483},[484,485,486,487],{"id":389,"depth":230,"text":390},{"id":403,"depth":230,"text":404},{"id":426,"depth":230,"text":427},{"id":473,"depth":230,"text":474},"patch-management","Patch the long tail of non-business-critical Java apps in days, not quarters, by replacing full regression testing with progressive rollout, fast detection and rehearsed rollback.","Fixed-scope rollout of a patching pipeline and governance model for a defined tier of applications, followed by patch cycles run each quarter.","For non-critical apps","i-lucide-zap",{},[495,496,497,498],"Security patches applied across the tier in days after each quarterly release","Progressive rollout with automated health gates","A rollback path that has been tested, not just documented","A CAB-approved standard-change process and audit trail",{"title":216,"description":489},"services\u002Frapid-patch","qDIP1lgG0nnDOEyokq47L3LSfKbmYPHSlBnCXM3udLw",{"id":503,"title":221,"body":504,"category":588,"description":589,"engagement":590,"extension":241,"headline":591,"icon":592,"meta":593,"navigation":245,"order":594,"outcomes":595,"path":220,"seo":600,"stem":601,"__hash__":602},"services\u002Fservices\u002Fcritical-patch-assurance.md",{"type":8,"value":505,"toc":576},[506,510,517,523,527,531,534,538,541,545,548,552,555,559,562,566,569,573],[11,507,509],{"id":508},"a-different-promise","A different promise",[16,511,512,513,516],{},"For business-critical applications the value proposition flips. We aren't removing testing. We ",[20,514,515],{},"compress"," it so that each test cycle is shorter and gives you more confidence, and full rigor becomes possible on a faster cadence.",[16,518,519,520,522],{},"This is a different engagement from ",[75,521,216],{"href":215},", built on a different premise, not the same thing done more carefully.",[11,524,526],{"id":525},"whats-in-it","What's in it",[298,528,530],{"id":529},"test-impact-analysis-and-risk-based-test-selection","Test impact analysis and risk-based test selection",[16,532,533],{},"We use code coverage and change-impact analysis to find which of your existing regression tests actually exercise code paths affected by the JVM change, and run those on a compressed timeline. When the signal is ambiguous we escalate to the full suite.",[298,535,537],{"id":536},"shadow-traffic-and-dark-launch-testing","Shadow traffic and dark launch testing",[16,539,540],{},"We mirror real production traffic to a shadow instance running the patched JVM and diff its outputs against production, with no user exposure. This is the strongest \"test better, not less\" option available for critical services.",[298,542,544],{"id":543},"upgrade-readiness-assessment","Upgrade readiness assessment",[16,546,547],{},"Before any patch or upgrade, we scan for removed and deprecated API usage, known agent incompatibilities and dependency issues, and produce a risk report up front.",[298,549,551],{"id":550},"staging-and-production-parity-audits","Staging and production parity audits",[16,553,554],{},"Much critical-app patch risk comes from drift between staging and production, not from the patch itself. Closing that gap often gives you more than adding tests does.",[298,556,558],{"id":557},"canary-gates-on-business-metrics","Canary gates on business metrics",[16,560,561],{},"We go beyond latency and error rates to business invariants, such as transaction success rate, order completion and revenue per minute, and use them as automated rollback triggers.",[298,563,565],{"id":564},"patch-trains-and-war-room-support","Patch trains and war-room support",[16,567,568],{},"Scheduled, batched patch windows for critical apps, with dedicated live support during rollout, instead of ad hoc patching.",[298,570,572],{"id":571},"lts-aligned-strategy-and-vendor-coordination","LTS-aligned strategy and vendor coordination",[16,574,575],{},"Critical apps stay on designated LTS and security baselines, which keeps exposure windows short without constant churn. Where it matters, we work directly with your JVM vendor on compatibility and support commitments.",{"title":229,"searchDepth":230,"depth":231,"links":577},[578,579],{"id":508,"depth":230,"text":509},{"id":525,"depth":230,"text":526,"children":580},[581,582,583,584,585,586,587],{"id":529,"depth":231,"text":530},{"id":536,"depth":231,"text":537},{"id":543,"depth":231,"text":544},{"id":550,"depth":231,"text":551},{"id":557,"depth":231,"text":558},{"id":564,"depth":231,"text":565},{"id":571,"depth":231,"text":572},"risk-governance","For business-critical Java applications, we compress testing instead of removing it, so full rigor fits a faster patch cadence.","A higher-touch engagement for critical applications, typically starting with an upgrade-readiness assessment and continuing with scheduled patch trains.","For the apps that run the business","i-lucide-shield",{},4,[596,597,598,599],"Shorter test cycles for critical apps with the same or greater confidence","Shadow-traffic validation with no user exposure","Canary gates on business metrics, not just infrastructure metrics","Scheduled patch trains with live war-room support",{"title":221,"description":589},"services\u002Fcritical-patch-assurance","utoXA8F7946svO9yfDqjkPV5VtPJhDVhuelRoxSfZeU",{"id":604,"title":605,"body":606,"category":676,"description":677,"engagement":678,"extension":241,"headline":679,"icon":680,"meta":681,"navigation":245,"order":682,"outcomes":683,"path":689,"seo":690,"stem":691,"__hash__":692},"services\u002Fservices\u002Fthird-party-applications.md","Vendor & Third-Party Application JVMs",{"type":8,"value":607,"toc":672},[608,612,622,625,627,667],[11,609,611],{"id":610},"the-jvms-nobody-owns","The JVMs nobody owns",[16,613,614,615,618,619,227],{},"A large share of the Java in an enterprise wasn't written there. Application servers, database tooling, CI\u002FCD servers, monitoring agents, ETL tools, security appliances and desktop software often ship their ",[20,616,617],{},"own private JVM",", installed outside the package manager and invisible to anything that only checks the system ",[331,620,621],{},"java",[16,623,624],{},"These runtimes fall between two chairs. The platform team assumes the vendor patches them; the vendor assumes you'll apply their next release; the application owner assumes it's all fine. Meanwhile the bundled JVM ages.",[11,626,296],{"id":295},[35,628,629,639,645,655,661],{},[38,630,631,634,635,638],{},[20,632,633],{},"Find and attribute them."," ",[75,636,637],{"href":253},"Discovery"," surfaces bundled runtimes and ties each one to a product, version and business owner.",[38,640,641,644],{},[20,642,643],{},"Establish the supportability position."," For each product: does the vendor ship JVM updates, do they support replacing the bundled runtime, and which JDK builds do they certify?",[38,646,647,650,651,654],{},[20,648,649],{},"Patch what can be patched."," Through vendor updates or supported runtime swaps, rolled out with the same ",[75,652,653],{"href":215},"detection and rollback discipline"," as your own apps.",[38,656,657,660],{},[20,658,659],{},"Protect what can't."," Network isolation, disabling vulnerable features, tighter access. The compensating controls are documented so your risk register reflects reality.",[38,662,663,666],{},[20,664,665],{},"Take it to the vendor."," Certified-JDK questions, SBOM requests and patch-timeline commitments, backed by the specific evidence you need for a contract conversation.",[84,668,669],{},[16,670,671],{},"Some commercial products include a restricted Oracle Java license for use with that product only. Whether a bundled Oracle runtime creates licensing exposure depends on the product's terms, so we check them rather than assuming either way.",{"title":229,"searchDepth":230,"depth":231,"links":673},[674,675],{"id":610,"depth":230,"text":611},{"id":295,"depth":230,"text":296},"third-party-apps","Advisory for the Java you don't build yourself, including commercial products, appliances and vendor-bundled runtimes, so they get patched or protected instead of forgotten.","Advisory engagement scoped per vendor portfolio, usually following a discovery engagement that surfaces the bundled runtimes.","Second- and third-party apps","i-lucide-package",{},5,[684,685,686,687],"Every vendor-bundled JVM identified and attributed to a product and owner","A supportability position for each (vendor update, supported JRE swap or neither)","Compensating controls where patching isn't possible",{"Vendor asks backed by evidence":688},"certified JDKs, SBOMs, patch timelines","\u002Fservices\u002Fthird-party-applications",{"title":605,"description":677},"services\u002Fthird-party-applications","oy1ThKLwcn-G3Z5DaUWp8Maj1EXsbbInm5duRfzyfRs",{"id":694,"title":196,"body":695,"category":238,"description":763,"engagement":764,"extension":241,"headline":202,"icon":765,"meta":766,"navigation":245,"order":767,"outcomes":768,"path":195,"seo":773,"stem":774,"__hash__":775},"services\u002Fservices\u002Fdrift-monitoring.md",{"type":8,"value":696,"toc":758},[697,701,704,707,711,747,751],[11,698,700],{"id":699},"assessments-go-stale","Assessments go stale",[16,702,703],{},"An estate assessment is accurate the day it's delivered. After that, teams deploy new services, vendors ship updates with new bundled runtimes, someone installs Oracle JDK on a build agent, and a new CVE lands against a version you thought was fine.",[16,705,706],{},"Continuous Drift Monitoring keeps the picture current. The inventory becomes a system of record instead of a PDF.",[11,708,710],{"id":709},"what-it-watches","What it watches",[35,712,713,719,725,731,737],{},[38,714,715,718],{},[20,716,717],{},"New and undocumented JVMs"," across hosts, containers and artifact repositories",[38,720,721,724],{},[20,722,723],{},"Patch-level drift",": which runtimes fell behind after each quarterly critical patch update",[38,726,727,730],{},[20,728,729],{},"New CVEs"," against the versions and dependencies you actually run",[38,732,733,736],{},[20,734,735],{},"License exposure changes",": a new Oracle JDK install is flagged before it shows up in an audit",[38,738,739,742,743,746],{},[20,740,741],{},"Classification triggers",", such as a new regulated data flow, a traffic spike or an incident, which force an application's ",[75,744,745],{"href":77},"risk tier"," to be re-scored",[11,748,750],{"id":749},"how-its-delivered","How it's delivered",[16,752,753,754,757],{},"Collection reuses the minimum-privilege methods from the ",[75,755,756],{"href":253},"original assessment",". Findings go to a shared dashboard and to the channels your teams already use. Each quarter, aligned to the Java patch calendar, we review drift, exposure and upcoming end-of-life dates with you.",{"title":229,"searchDepth":230,"depth":231,"links":759},[760,761,762],{"id":699,"depth":230,"text":700},{"id":709,"depth":230,"text":710},{"id":749,"depth":230,"text":750},"Keep your JVM inventory, patch posture and Oracle license exposure current as the estate changes, instead of commissioning a new assessment every year.","Ongoing subscription after an estate assessment. Continuous collection, alerting on meaningful changes, and a quarterly review aligned to the Java patch calendar.","i-lucide-refresh-cw",{},6,[769,770,771,772],"New and undocumented JVMs detected as they appear","Patch-level drift tracked against each quarterly release","Alerts when a new install creates Oracle license exposure","Automatic re-classification when an app's risk profile changes",{"title":196,"description":763},"services\u002Fdrift-monitoring","Phmhi-GcB9IZ5dN4HFjsW_dg9QF_D9rXUNzILnRNAKE",{"id":777,"title":778,"author":779,"body":780,"category":1267,"date":1268,"description":1269,"draft":1270,"extension":241,"featured":1270,"image":1271,"meta":1272,"navigation":245,"path":356,"readingTime":767,"seo":1273,"stem":1274,"tags":1275,"updated":1271,"__hash__":1282},"articles\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist.md","Oracle JDK to OpenJDK: a practical migration checklist","patchmageddon-team",{"type":8,"value":781,"toc":1250},[782,789,792,795,799,802,819,826,830,833,927,930,968,972,975,979,993,997,1017,1021,1041,1045,1077,1081,1086,1090,1102,1106,1109,1130,1141,1145,1151,1177,1181,1187,1191,1235,1239],[16,783,784,785,788],{},"For most server workloads, moving from Oracle JDK to an OpenJDK distribution of the ",[20,786,787],{},"same version"," is one of the lowest-risk changes you can make to a Java runtime. Oracle JDK and the major OpenJDK builds come from the same source code, and the reputable distributions are tested against the Java SE Technology Compatibility Kit (TCK).",[16,790,791],{},"\"Low risk\" isn't \"no risk,\" though. The failures we see in vendor swaps are rarely about Java language behavior. They come from what surrounds the runtime: trust stores, install paths, startup flags, bundled components and applications that look for Oracle specifically.",[16,793,794],{},"This checklist is what we work through on every migration.",[11,796,798],{"id":797},"step-0-know-what-youre-migrating","Step 0: Know what you're migrating",[16,800,801],{},"You can't migrate what you haven't found. Before you pick a distribution, you need a list of every Oracle JDK and JRE with:",[35,803,804,807,810,813,816],{},[38,805,806],{},"host, container image or artifact where it lives",[38,808,809],{},"version and exact build",[38,811,812],{},"whether it's standalone, used by an app server, or bundled inside a vendor product",[38,814,815],{},"the application and owner that depend on it",[38,817,818],{},"how it gets there (golden image, config management, manual install, vendor installer)",[16,820,821,822,227],{},"That last field matters more than people expect. If you migrate a server but the golden image still installs Oracle JDK, it comes back on the next rebuild. See ",[75,823,825],{"href":824},"\u002Farticles\u002Ffinding-every-jvm-in-your-estate","finding every JVM in your estate",[11,827,829],{"id":828},"step-1-choose-a-distribution","Step 1: Choose a distribution",[16,831,832],{},"Several vendors publish free, production-ready OpenJDK builds. Most also offer paid support. The main ones:",[130,834,835,848],{},[133,836,837],{},[136,838,839,842,845],{},[139,840,841],{},"Distribution",[139,843,844],{},"Maintainer",[139,846,847],{},"Notes",[152,849,850,861,872,883,894,905,916],{},[136,851,852,855,858],{},[157,853,854],{},"Eclipse Temurin",[157,856,857],{},"Eclipse Adoptium",[157,859,860],{},"Widely used vendor-neutral default; commercial support available from third parties",[136,862,863,866,869],{},[157,864,865],{},"Amazon Corretto",[157,867,868],{},"Amazon",[157,870,871],{},"Free; used heavily inside AWS",[136,873,874,877,880],{},[157,875,876],{},"Azul Zulu",[157,878,879],{},"Azul",[157,881,882],{},"Free builds; broad platform and older-version coverage; paid support available",[136,884,885,888,891],{},[157,886,887],{},"Red Hat build of OpenJDK",[157,889,890],{},"Red Hat",[157,892,893],{},"Natural fit for RHEL estates; supported through Red Hat subscriptions",[136,895,896,899,902],{},[157,897,898],{},"Microsoft Build of OpenJDK",[157,900,901],{},"Microsoft",[157,903,904],{},"Covers recent LTS releases (11 onward); used across Azure",[136,906,907,910,913],{},[157,908,909],{},"BellSoft Liberica",[157,911,912],{},"BellSoft",[157,914,915],{},"Offers \"full\" builds that include JavaFX",[136,917,918,921,924],{},[157,919,920],{},"IBM Semeru Runtimes",[157,922,923],{},"IBM",[157,925,926],{},"Uses the Eclipse OpenJ9 VM, not HotSpot, so a bigger behavioral change",[16,928,929],{},"The criteria that actually matter:",[35,931,932,938,944,950,956,962],{},[38,933,934,937],{},[20,935,936],{},"LTS support length."," How long will this vendor ship security updates for the versions you run? Check the vendor's published roadmap for each version you need, especially Java 8 and 11.",[38,939,940,943],{},[20,941,942],{},"Update cadence."," Updates should follow the quarterly Critical Patch Update schedule (January, April, July, October), released promptly after each one.",[38,945,946,949],{},[20,947,948],{},"Commercial support."," Do you need a contract and an SLA for production incidents? Some distributions sell support directly; for others it's available from third parties.",[38,951,952,955],{},[20,953,954],{},"Platform coverage."," Operating systems, CPU architectures (x86-64, ARM64), container base images, and installers for Windows if you have Windows servers or desktops.",[38,957,958,961],{},[20,959,960],{},"TCK certification."," Confirm the builds you'll use are TCK-tested for the versions you need.",[38,963,964,967],{},[20,965,966],{},"Standardization."," One distribution across the estate is usually easier to patch, scan and support than several. Pick one default and allow exceptions only with a reason.",[11,969,971],{"id":970},"step-2-check-the-known-differences","Step 2: Check the known differences",[16,973,974],{},"These are the areas where vendor swaps actually cause problems.",[298,976,978],{"id":977},"removed-or-unbundled-components-mostly-java-8","Removed or unbundled components (mostly Java 8)",[35,980,981,987],{},[38,982,983,986],{},[20,984,985],{},"JavaFX."," Oracle JDK 8 bundled JavaFX. Most OpenJDK 8 builds don't. Applications with JavaFX user interfaces need a build that includes it (some vendors offer these) or a separate OpenJFX dependency.",[38,988,989,992],{},[20,990,991],{},"Java Web Start and the browser plugin."," These were part of Oracle JDK 8 but were never in OpenJDK, and were removed from Oracle JDK in 11. Applications launched via JNLP need an alternative launcher such as OpenWebStart, or a different delivery method.",[298,994,996],{"id":995},"startup-flags","Startup flags",[35,998,999,1011],{},[38,1000,1001,1006,1007,1010],{},[20,1002,1003,227],{},[331,1004,1005],{},"-XX:+UnlockCommercialFeatures"," Older Oracle JDK 8 builds needed this flag to enable Java Flight Recorder, which was a commercial feature at the time. Startup scripts that still pass it may fail with an unrecognized-option error on other runtimes, which means the JVM ",[20,1008,1009],{},"doesn't start",". Search every start script, service unit, container entrypoint and app-server config for commercial and Oracle-specific flags.",[38,1012,1013,1016],{},[20,1014,1015],{},"Deprecated or obsolete flags"," in general. If the migration also changes the build level, check the startup options against the target version's documentation.",[298,1018,1020],{"id":1019},"trust-stores","Trust stores",[35,1022,1023,1032],{},[38,1024,1025,1031],{},[20,1026,1027,1030],{},[331,1028,1029],{},"cacerts"," contents differ between vendors."," Each distribution curates its own default set of trusted root CAs. If an application connects to a partner or internal service whose certificate chains to a root that's in Oracle's store but not your new vendor's, TLS handshakes will fail.",[38,1033,1034,1037,1038,1040],{},[20,1035,1036],{},"Custom certificates added by hand"," to the old JDK's ",[331,1039,1029],{}," will not be carried over. Inventory them and re-import them, or better, move to a managed trust store outside the JDK directory.",[298,1042,1044],{"id":1043},"paths-installers-and-registry-keys","Paths, installers and registry keys",[35,1046,1047,1055,1064],{},[38,1048,1049,1054],{},[20,1050,1051,1053],{},[331,1052,333],{}," and hard-coded paths."," Scripts and service definitions often point at paths like an Oracle-specific install directory. Find them before you uninstall anything.",[38,1056,1057,1060,1061,1063],{},[20,1058,1059],{},"Windows registry keys."," Some applications find Java through Oracle's registry entries instead of ",[331,1062,333],{},". Check whether your chosen distribution's installer can set compatible keys, and test the applications that depend on them.",[38,1065,1066,1069,1070,1072,1073,1076],{},[20,1067,1068],{},"Alternatives and symlinks"," on Linux. Make sure ",[331,1071,621],{}," on the ",[331,1074,1075],{},"PATH"," resolves to the runtime you think it does.",[298,1078,1080],{"id":1079},"rendering-and-fonts","Rendering and fonts",[35,1082,1083],{},[38,1084,1085],{},"Older Oracle JDK 8 builds used a different font rasterizer from OpenJDK builds, so reports, PDF generation and desktop UIs can render text slightly differently. This rarely matters for services, but it can for document-generation workloads.",[298,1087,1089],{"id":1088},"vendor-certification","Vendor certification",[35,1091,1092],{},[38,1093,1094,1097,1098,227],{},[20,1095,1096],{},"Third-party products that certify only Oracle JDK."," Some commercial applications list only Oracle JDK in their support matrix. Running them on another build may be technically fine and still unsupported. Ask the vendor, get the answer in writing, and record it. See ",[75,1099,1101],{"href":1100},"\u002Farticles\u002Fpatching-jvms-inside-vendor-products","patching JVMs inside vendor products",[11,1103,1105],{"id":1104},"step-3-verify-then-roll-out-progressively","Step 3: Verify, then roll out progressively",[16,1107,1108],{},"For a same-version vendor swap on a non-critical application, you usually don't need a full regression cycle. You do need:",[1110,1111,1112,1118,1124],"ol",{},[38,1113,1114,1117],{},[20,1115,1116],{},"Smoke tests"," covering startup, the main user paths, outbound TLS connections and scheduled jobs.",[38,1119,1120,1123],{},[20,1121,1122],{},"A canary."," Move one instance or a small share of traffic first, and compare error rates, latency, GC behavior and log noise with the old runtime.",[38,1125,1126,1129],{},[20,1127,1128],{},"A tested rollback."," Keep the previous runtime available until the new one has been stable for an agreed period, and know exactly how to switch back.",[16,1131,1132,1133,1137,1138,227],{},"For business-critical systems, add shadow-traffic comparison or targeted regression tests on the paths most exposed to runtime differences. We describe the thinking in ",[75,1134,1136],{"href":1135},"\u002Farticles\u002Ffast-detection-and-rollback-instead-of-regression-testing","fast detection and rollback instead of regression testing"," and the common failure patterns in ",[75,1139,1140],{"href":462},"how JVM patches break production",[11,1142,1144],{"id":1143},"step-4-remove-oracle-dont-just-re-point","Step 4: Remove Oracle, don't just re-point",[16,1146,1147,1148,1150],{},"This is where many migrations stop short. Changing ",[331,1149,333],{}," to the new runtime leaves the Oracle binaries on disk, and from a licensing point of view an installed Oracle JDK is still an Oracle JDK.",[35,1152,1153,1159,1165,1171],{},[38,1154,1155,1158],{},[20,1156,1157],{},"Uninstall"," Oracle JDK and JRE packages, and delete leftover directories.",[38,1160,1161,1164],{},[20,1162,1163],{},"Update the sources",": golden images, container base images, configuration-management roles, internal package mirrors and software catalogs.",[38,1166,1167,1170],{},[20,1168,1169],{},"Block reintroduction."," Add a check in image builds or CI that fails if an Oracle JDK appears.",[38,1172,1173,1176],{},[20,1174,1175],{},"Re-scan"," after cleanup to confirm nothing remains.",[11,1178,1180],{"id":1179},"step-5-keep-the-evidence","Step 5: Keep the evidence",[16,1182,1183,1184,227],{},"Record what was migrated or removed, where, when and by whom, with before-and-after scan output. If a licensing review happens later, dated evidence of removal is far more persuasive than a statement that \"we moved off Oracle last year.\" This matters especially given ",[75,1185,1186],{"href":350},"how Oracle's employee-based metric works",[11,1188,1190],{"id":1189},"the-checklist","The checklist",[1110,1192,1193,1196,1199,1202,1205,1211,1214,1220,1223,1226,1229,1232],{},[38,1194,1195],{},"Build a complete inventory of Oracle JDK and JRE installs, including bundled and containerized ones.",[38,1197,1198],{},"Record the owner, the dependent applications and how each install gets provisioned.",[38,1200,1201],{},"Choose a default OpenJDK distribution and document the exceptions policy.",[38,1203,1204],{},"Flag JavaFX, Java Web Start and other Oracle-8-only dependencies.",[38,1206,1207,1208,1210],{},"Search startup configuration for ",[331,1209,1005],{}," and other Oracle-specific or obsolete flags.",[38,1212,1213],{},"Compare trust stores and re-import custom certificates.",[38,1215,1216,1217,1219],{},"Find hard-coded paths, ",[331,1218,333],{}," settings and registry dependencies.",[38,1221,1222],{},"Confirm vendor support for third-party products, in writing.",[38,1224,1225],{},"Smoke test, canary and keep a rehearsed rollback.",[38,1227,1228],{},"Uninstall Oracle binaries and fix the golden images and automation that installed them.",[38,1230,1231],{},"Re-scan to confirm removal.",[38,1233,1234],{},"Archive the evidence.",[11,1236,1238],{"id":1237},"what-to-do-next","What to do next",[16,1240,1241,1242,1245,1246,1249],{},"If you want this done on a fixed timeline, our ",[75,1243,1244],{"href":225},"OpenJDK migration service"," runs the whole checklist, starting from a ",[75,1247,1248],{"href":253},"JVM discovery and estate assessment"," so nothing gets missed.",{"title":229,"searchDepth":230,"depth":231,"links":1251},[1252,1253,1254,1262,1263,1264,1265,1266],{"id":797,"depth":230,"text":798},{"id":828,"depth":230,"text":829},{"id":970,"depth":230,"text":971,"children":1255},[1256,1257,1258,1259,1260,1261],{"id":977,"depth":231,"text":978},{"id":995,"depth":231,"text":996},{"id":1019,"depth":231,"text":1020},{"id":1043,"depth":231,"text":1044},{"id":1079,"depth":231,"text":1080},{"id":1088,"depth":231,"text":1089},{"id":1104,"depth":230,"text":1105},{"id":1143,"depth":230,"text":1144},{"id":1179,"depth":230,"text":1180},{"id":1189,"depth":230,"text":1190},{"id":1237,"depth":230,"text":1238},"openjdk-migration","2026-09-08","A step-by-step checklist for moving from Oracle JDK to an OpenJDK build: choosing a distribution, what differs between vendors, verification and cleanup.",false,null,{},{"title":778,"description":1269},"articles\u002Foracle-jdk-to-openjdk-migration-checklist",[1276,1277,1278,1279,1280,1281],"openjdk","oracle-java","migration","temurin","corretto","zulu","3wYnAM2s__rsMjzNJvmeHU4vhiOOa4RHGxad2U61D08",{"id":1284,"avatar":1285,"bio":1286,"extension":1287,"kind":1288,"links":1289,"meta":1294,"name":1295,"role":1296,"stem":1297,"__hash__":1298},"authors\u002Fauthors\u002Fpatchmageddon-team.yml","\u002Ffavicon.svg","The Patchmageddon team helps enterprises find every JVM in their estate, patch it on a sane cadence, and stop paying for Oracle Java they don't need.","yml","organization",[1290],{"label":1291,"icon":1292,"to":1293},"LinkedIn","i-simple-icons-linkedin","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fpatchmageddon",{},"Patchmageddon Team","JVM patching & OpenJDK migration specialists","authors\u002Fpatchmageddon-team","4HFxqSUgKzMH-9PhrByUwSJBQRn96t7Og1rkYrP4XnM",[],[1301,1305],{"title":1302,"path":350,"stem":1303,"description":1304,"children":-1},"How Oracle's employee-based Java metric works, and why a few installs can price your whole company","articles\u002Foracle-java-employee-metric-explained","Oracle's Java SE Universal Subscription is priced per employee, not per install. How the metric works, a worked example, and why your inventory drives the cost.",{"title":1306,"path":824,"stem":1307,"description":1308,"children":-1},"You can't patch what you can't find: building a real JVM inventory","articles\u002Ffinding-every-jvm-in-your-estate","Most enterprises can't say how many JVMs they run or where. Here's what a useful JVM inventory captures, how to collect it, and where it goes wrong.",1790355850218]