Java Upgrade 21.x (Ubuntu)

This article provides step-by-step instructions to upgrade Java from JDK 17 to JDK 21 on an Ubuntu machine. It includes procedures for stopping Apache Tomcat services, installing Java 21, updating the default Java version, and restoring SSL certificates from the existing Java installation. The article also covers verification steps to ensure the upgraded Java version integrates successfully with Apache Tomcat services. This upgrade helps maintain compatibility, security, and performance for OvalEdge deployments and related services.

Prerequisites

Complete the following prerequisites before starting the upgrade:

• Ensure sudo or root access is available on the Ubuntu machine.

• Back up the existing Java options and heap settings configured for Apache Tomcat services.

• Stop all Tomcat services before starting the upgrade.

• Ensure internet access is available to download the required JDK packages.

• Verify sufficient disk space is available for installation.

• Validate Java 17 and Java 21 compatibility requirements for Elasticsearch 9.x before starting the upgrade.

Stop Apache Tomcat Services

1. Stop all running Tomcat services before upgrading Java.

2. Run the following command to stop the default Tomcat service:

   sudo systemctl stop tomcat.service

3. If multiple Tomcat instances are running, stop each instance separately:

   sudo systemctl stop tomcat-ui
   sudo systemctl stop tomcat-job

4. Verify the Tomcat service status:

   sudo systemctl status tomcat

Verify Current Java Version

1. Verify the currently installed Java version before starting the upgrade.

2. Run the following command:

   java -version

3. Expected output:

   openjdk version "17.x.x"

   Sample Reference Screenshot:

   

Back Up Existing cacerts File

Back up the existing cacerts file to preserve custom SSL certificates.

1. Run the following command to create a backup directory:

   mkdir -p /home/ubuntu/cacertsbackup

2. Navigate to the existing Java security directory and run the following command:

   cd /usr/lib/jvm/java-17-openjdk-amd64/lib/security

3. Run the following command to back up the cacerts file:

   cp cacerts /home/ubuntu/cacertsbackup/

   Sample Reference Screenshot:

   

4. To verify backup, run the following command:

   ls -l /home/ubuntu/cacertsbackup

   Sample Reference Screenshot:

   

Update System Packages

1. Update the Ubuntu package repository and installed packages.

2. Run the following commands:

   sudo apt update
   sudo apt upgrade -y

Install Java 21

1. Install OpenJDK 21 using the Ubuntu package repository.

2. Run the following command:

   sudo apt install openjdk-21-jdk -y

   Sample Reference Screenshot:

   
3. Verify the installation:

   java -version

   Sample Reference Screenshot:

   

Verify Installed Java Versions

1. Verify all installed Java versions on the machine.

2. Run the following command:

   sudo update-alternatives --list java

   Sample Reference Screenshot:

   
3. Expected output:

   /usr/lib/jvm/java-17-openjdk-amd64/bin/java
   /usr/lib/jvm/java-21-openjdk-amd64/bin/java

Set Java 21 as the Default Version

1. Configure Java 21 as the default Java version.

2. Run the following command:

   sudo update-alternatives --config java

3. Select the option corresponding to Java 21 from the displayed list. Sample Reference Screenshot:

   

Verify Java Upgrade

1. Verify that the system is using Java 21 as the active Java version.

2. Run the following command:

   java -version

3. Expected output:

   openjdk version "21.0.10" 2026-01-20
   OpenJDK Runtime Environment (build 21.0.10+7-Ubuntu-122.04)
   OpenJDK 64-Bit Server VM (build 21.0.10+7-Ubuntu-122.04, mixed mode, sharing)

Restore cacerts File

Restore the previously backed-up cacerts file into the Java 21 security directory.

Copy Backup cacerts File

1. Run the following command:

   sudo cp /home/ubuntu/cacertsbackup/cacerts /usr/lib/jvm/java-21-openjdk-amd64/lib/security/

Update File Permissions

1. Set the required permissions for the restored file:

   sudo chmod 644 /usr/lib/jvm/java-21-openjdk-amd64/lib/security/cacerts

Update File Ownership

1. Set the correct ownership for the restored file:

   sudo chown root:root /usr/lib/jvm/java-21-openjdk-amd64/lib/security/cacerts

Verify Restored File

1. Run the following command:

   ls -l /usr/lib/jvm/java-21-openjdk-amd64/lib/security/cacerts

2. Expected output:

   -rw-r--r-- 1 root root <size> <date> cacerts

Start Apache Tomcat Services

1. Restart Apache Tomcat services after completing the Java upgrade.

2. Run the following command:

   sudo systemctl start tomcat

3. Verify the Tomcat service status:

   sudo systemctl status tomcat

4. If multiple Tomcat instances are configured, start each service separately:

   sudo systemctl start tomcat-ui
   sudo systemctl start tomcat-job

---

Copyright © 2026, OvalEdge LLC, Peachtree Corners, GA, USA.