Automic V24.4 and compatibility with Java OpenJDK JRE V20?

[Marike Gottschalck]

Hello,

CORRECTION OF TITLE: Java OpenJDK JRE V24

we've had endless problems with Windows Server 2022 and OpenJDK V17, since it is having a few bugs, apparently. For agents on Windows we switched to the V17 Java pack provided in the CAU zip file, but this one does not seem to work for the AE. Unfortunately, the Openjdk Java V17 versions seems to have problem with accessing WINDOWS-ROOT certificate store, for agents our downloaded versions had problems with 

#

# A fatal error has been detected by the Java Runtime Environment:

#

#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x0000000000000000, pid=4444, tid=11808

#

# JRE version:  (17.0.14+7) (build )

# Java VM: OpenJDK 64-Bit Server VM (17.0.14+7-adhoc..jdk17u, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, windows-amd64)

# Problematic frame:

# C  [jimage.dll+0x1827]

#

# Core dump will be written. Default location: C:\Applikationen\Automic\Agents\AWAT\Windows\bin\hs_err_pid4444.mdmp

As mentioned, the last issue was solved by using the jre from the Automic CAU pack. But what about the JRE for the AE? Tricise support told us not to use the JRE V21 in case of any problems that might need to get forwarded to Broadcom, but the problem with using cacerts is, that any updates are not performed automatically by the company, for the Windows Certitficate store every update is distributed automatically.

Suggestions which JRE Versions (not Oracle though :-) ) we can use, or if it is officially okay to use the JRE V21/V24 despite it not being on the compatibility matrix would be appreciated.

Kind regards

Marike Gottschalck

Edit: sorry: jre V21 for the agent; our windows server specialist downloaded jre v24 yesterday to try to solve the issue with Windows-Root and used it for LDAP.Sync which worked fine, I retested with V21, that is bugged as well, only V24 is working fine.)

[Michael Ham]

You -must- use what is on the Compatibility Matrix to have support when there is a need to escalate to Broadcom. If you use other than JDK 17 you are risking support.

Automic Download Center - Compatibility Matrix web page indicates in the banner that higher versions are supported^.

The listed versions of 3rd party platforms (operating systems, databases, Java) represent the versions we internally test and support, ensuring they function as expected.

^Newer versions may be used as long as the vendor guarantees backward compatibility / compatibility, but we can only assure support and performance for the versions explicitly listed.

Other references that are misleading.
"As of 24.4.0, Automic Automation requires Java version 17 or higher"  (wrong! if you want support)

https://docs.automic.com/documentation/WEBHELP/English/AA/21.0/DOCU/24.4.0/Automic%20Automation%20Guides/Content/_Common/ReleaseHighlights/WhatsNew_24_4_0.htm#link8
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/ReleaseAnnouncements/0/25510

-------------------------------------------

[Daryl Brown]

Hi Marike,

Could you shed some more light on how you fixed these windows agent CAU issues with openjdk 17?  We're seeing the same issues now trying to CAU some of our agents where we've (manually) installed openjdk 17 in the agents' bin/jre/ folder.  You said you solved the problem by "using the jre from the Automic CAU pack", but what pack is this, exactly?  ("Automic Windows Agent CAU"?  I've downloaded the 24.4.1hf2 agent CAU pack and opened the zip file, but do not see a java jre to install anywhere.)

Thanks in advance!

-------------------------------------------

[Vandy Travelstead]

If you have this

installed when you run the Windows CAU upgrade to 24.4  -- it will automatically add the JRE to the agent bin directory during the upgrade of the agent.  These started automatically for us after the CAU upgrade on our Windows agents.  

The problem we had that took so much time was clearing the security files created by the engine from the /bin/security folder of each Linux/Unix agent (not the .cert file).  Those files had to be re-generated by the AE before the Linux agents would start.

We also had to highlight the Agent in the Admin tab in Client 0, right click and Reset Agent Public Key.

I mention this only because I don't know if that might be some of what you are experiencing, but with Windows.  

[Marike Gottschalck]

Hello Daryl,

We use PCK.AUTOMIC_CAU_JRE_WINDOWS to manage the java packages within our agents (there’s one for UNIX as well). So we used a working java version (V21) to upgrade the agent after installation, which changed the java package to a small V17 one. We use the V17 one for our agent installations now, since this one is working. No idea if you can unzip the jre directly, or if this gets automatically added to the download package if installed so you don’t have to take the long road with a OpenJDK JRE v21 first ☺

Trying to answer by email since something happened to my user and I now get permission denied for this thread.

But seriously, all those Java issues with a hardened windows 2022 are getting seriously on my nerves, and produce a lot of certificate overhead for us. No idea how to resolve this in the future, since unhardening the system is NOT an option.

Kind regards
Marike

==================================

Hannover Rück SE, Handelsregister (Commercial Register) Hannover HRB 6778 / E+S Rückversicherung AG, Handelsregister (Commercial Register) Hannover HRB 6117; für beide Gesellschaften gilt (applicable to both companies): Karl-Wiechert-Allee 50, 30625 Hannover, Germany; Sitz (registered office) der Gesellschaften: Hannover; Aufsichtsrat (Supervisory Board): Torsten Leue (Vorsitzender/Chairman); Vorstand (Executive Board) Hannover Rück SE: Clemens Jungsthöfel (Vorsitzender/Chairman), Sven Althoff, Claude Chèvre, Dr. Christian Hermelingmeier, Brona Magee, Sharon Ooi, Silke Sehm, Thorsten Steinmann; Vorstand (Executive Board) E+S Rückversicherung AG: Thorsten Steinmann (Vorsitzender/Chairman), Dr. Christian Hermelingmeier

Data privacy notice: We process personal data for our business purposes (e.g. providing reinsurance, reviewing and managing claims, advising insurers). Where the purpose of processing is to deal with other inquiries, the legal basis for processing is Art. 6 (1) f) GDPR (legitimate interest). As the responsible controller under data protection law, we provide information in accordance with the respective legal provisions governing data protection (e.g. further processing purposes, storage period, rights of data subjects):
For Hannover Rück SE: https://www.hannover-re.com/privacy | For E+S Rückversicherung AG: https://www.es-rueck.de/datenschutz-es

Hinweis zum Datenschutz: Wir verarbeiten personenbezogene Daten für unsere Geschäftszwecke (z.B. Angebot von Rückversicherung, Schadenprüfung und -regulierung, Beratung von Versicherungsunternehmen). Erfolgt die Verarbeitung zur Bearbeitung sonstiger Anfragen, ist die Rechtsgrundlage der Verarbeitung Art. 6 Abs. 1 f) DSGVO (berechtigtes Interesse). Als datenschutzrechtlich Verantwortliche informieren wir jeweils gemäß den gesetzlichen Bestimmungen zum Datenschutz (z.B. weitere Verarbeitungszwecke, Speicherdauer, Betroffenenrechte):
Für die Hannover Rück SE: https://www.hannover-rueck.de/datenschutz | Für die E+S Rückversicherung AG: https://www.es-rueck.de/datenschutz-es

[Daryl Brown]

Thank you both, Vandy and Marike.  I hadn't realized there were new CAU_JRE packs involved with the CAU process starting with v24.  That definitely makes life a lot easier.  :)

Question for you, though...  When you need to install an agent on a brand new server, how do you tackle the JRE install? 

• Do you just manually unzip the JRE from the CAU_JRE zip file?
• Do you make sure openjdk 17 is already installed on the server prior to installing the agent, and not worry about a jre folder for the agent?
• Do you just install it as a v21 agent (that doesn't require java in the first place) and then CAU it up to v24.x?

-------------------------------------------

[Marike Gottschalck]

Hi Daryl, currently we deliver with a JRE V21 (in the bin folder) and update right after that. But you could take one “finished” installation and take the unzipped jre folder from there for your installation pack.

Kind regards
Marike

==================================

Hannover Rück SE, Handelsregister (Commercial Register) Hannover HRB 6778 / E+S Rückversicherung AG, Handelsregister (Commercial Register) Hannover HRB 6117; für beide Gesellschaften gilt (applicable to both companies): Karl-Wiechert-Allee 50, 30625 Hannover, Germany; Sitz (registered office) der Gesellschaften: Hannover; Aufsichtsrat (Supervisory Board): Torsten Leue (Vorsitzender/Chairman); Vorstand (Executive Board) Hannover Rück SE: Clemens Jungsthöfel (Vorsitzender/Chairman), Sven Althoff, Claude Chèvre, Dr. Christian Hermelingmeier, Brona Magee, Sharon Ooi, Silke Sehm, Thorsten Steinmann; Vorstand (Executive Board) E+S Rückversicherung AG: Thorsten Steinmann (Vorsitzender/Chairman), Dr. Christian Hermelingmeier

Data privacy notice: We process personal data for our business purposes (e.g. providing reinsurance, reviewing and managing claims, advising insurers). Where the purpose of processing is to deal with other inquiries, the legal basis for processing is Art. 6 (1) f) GDPR (legitimate interest). As the responsible controller under data protection law, we provide information in accordance with the respective legal provisions governing data protection (e.g. further processing purposes, storage period, rights of data subjects):
For Hannover Rück SE: https://www.hannover-re.com/privacy | For E+S Rückversicherung AG: https://www.es-rueck.de/datenschutz-es

Hinweis zum Datenschutz: Wir verarbeiten personenbezogene Daten für unsere Geschäftszwecke (z.B. Angebot von Rückversicherung, Schadenprüfung und -regulierung, Beratung von Versicherungsunternehmen). Erfolgt die Verarbeitung zur Bearbeitung sonstiger Anfragen, ist die Rechtsgrundlage der Verarbeitung Art. 6 Abs. 1 f) DSGVO (berechtigtes Interesse). Als datenschutzrechtlich Verantwortliche informieren wir jeweils gemäß den gesetzlichen Bestimmungen zum Datenschutz (z.B. weitere Verarbeitungszwecke, Speicherdauer, Betroffenenrechte):
Für die Hannover Rück SE: https://www.hannover-rueck.de/datenschutz | Für die E+S Rückversicherung AG: https://www.es-rueck.de/datenschutz-es

[Eric Lontz]

We just upgraded from version 21 to version 24and were fairly annoyed when we had to constantly replace the jre with an updated one afterward. I did find something out after completing the upgrade. The STORE objects which contains the jre.zip or jre.tgz are PCK.AUTOMIC_CAU_JRE_WINDOWS.PRV.STORE.24.4.0@BUILD.1741632905302 and PCK.AUTOMIC_CAU_JRE_UNIX.PRV.STORE.24.4.0@BUILD.1741632905302.

You should be able to get the jre from adoptium.net (17.0.2 adoptium is used in the current jre.tgz or jre.zip)  https://adoptium.net/temurin/releases?version=17&os=windows&arch=x64&mode=filter. You will have to extract the files, rename the folder they extract into to jre, then re-tgz or re-zip the file. and you should be able to upload that file into the STORE object to have that version of jre automatically extracted. 

I haven't yet tested this out, but it should work.

-------------------------------------------

[Jared Kessans]

If using PCK.AUTOMIC_CAU_JRE_WINDOWS so that it installs the JRE, how do you handle the certificates?  I tried it with a Sandbox agent and it upgrades the agent, installs the JRE, but then get the error "PKIX path building failed: unable to find valid certification path to requested target" and the agent fails to start.  

I originally had this agent at 24.4.2 just using the normal agent package PCK.AUTOMIC_CAU_AGENT_WINDOWS.  I backed it out to v21.0.14 since that's what we have in all other environments while I determine the upgrade path.

But with the JRE getting installed using PCK.AUTOMIC_CAU_JRE_WINDOWS, it fails due to the certificate. 

Do you have to handle the certs differently when using PCK.AUTOMIC_CAU_JRE_WINDOWS?

-------------------------------------------

[Marike Gottschalck]

We deliver the Root certificates with out package (have done so for initial installation since V21), and I can‘t remember this error while using the working jre. We had to get rid of any windows-root option for our java parameters, but you could try if it works for you. The binary will pass java options through to java. I highly recommend using java memory restriction options as well.

Kind regards
Marike

==================================

Hannover Rück SE, Handelsregister (Commercial Register) Hannover HRB 6778 / E+S Rückversicherung AG, Handelsregister (Commercial Register) Hannover HRB 6117; für beide Gesellschaften gilt (applicable to both companies): Karl-Wiechert-Allee 50, 30625 Hannover, Germany; Sitz (registered office) der Gesellschaften: Hannover; Aufsichtsrat (Supervisory Board): Torsten Leue (Vorsitzender/Chairman); Vorstand (Executive Board) Hannover Rück SE: Clemens Jungsthöfel (Vorsitzender/Chairman), Sven Althoff, Claude Chèvre, Dr. Christian Hermelingmeier, Brona Magee, Sharon Ooi, Silke Sehm, Thorsten Steinmann; Vorstand (Executive Board) E+S Rückversicherung AG: Thorsten Steinmann (Vorsitzender/Chairman), Dr. Christian Hermelingmeier

Data privacy notice: We process personal data for our business purposes (e.g. providing reinsurance, reviewing and managing claims, advising insurers). Where the purpose of processing is to deal with other inquiries, the legal basis for processing is Art. 6 (1) f) GDPR (legitimate interest). As the responsible controller under data protection law, we provide information in accordance with the respective legal provisions governing data protection (e.g. further processing purposes, storage period, rights of data subjects):
For Hannover Rück SE: https://www.hannover-re.com/privacy | For E+S Rückversicherung AG: https://www.es-rueck.de/datenschutz-es

Hinweis zum Datenschutz: Wir verarbeiten personenbezogene Daten für unsere Geschäftszwecke (z.B. Angebot von Rückversicherung, Schadenprüfung und -regulierung, Beratung von Versicherungsunternehmen). Erfolgt die Verarbeitung zur Bearbeitung sonstiger Anfragen, ist die Rechtsgrundlage der Verarbeitung Art. 6 Abs. 1 f) DSGVO (berechtigtes Interesse). Als datenschutzrechtlich Verantwortliche informieren wir jeweils gemäß den gesetzlichen Bestimmungen zum Datenschutz (z.B. weitere Verarbeitungszwecke, Speicherdauer, Betroffenenrechte):
Für die Hannover Rück SE: https://www.hannover-rueck.de/datenschutz | Für die E+S Rückversicherung AG: https://www.es-rueck.de/datenschutz-es

Gesendet von Outlook für iOS<https: aka.ms o0ukef>
________________________________
Von: Jared Kessans via Broadcom <[e-mail]>
Gesendet: Friday, November 21, 2025 6:41:38 PM
An: Marike Gottschalck <[e-mail]>
Betreff: RE: Automic Workload Automation: Automic V24.4 and compatibility with Java OpenJDK JRE V20?

EXTERNAL EMAIL WARNING - Do not click links or open attachments unless you recognize the sender and know that the content is safe!

________________________________
If using PCK.AUTOMIC_CAU_JRE_WINDOWS so that it installs the JRE, how do you handle the certificates? I tried it with a Sandbox agent and it... -posted to the "Automic Workload Automation" community
[Broadcom] <https: community.broadcom.com>
Automic Workload Automation<https: community.broadcom.com communities community-home digestviewer?communitykey=2e1b01c9-f310-4635-829f-aead2f6587c4>
Post New Message<mailto:[e-mail]>
Re: Automic V24.4 and compatibility with Java OpenJDK JRE V20?<https: community.broadcom.com discussion automic-v244-and-compatibility-with-java-openjdk-jre-v20#bmc54036c2-fa15-40cd-9cf6-019aa7766933>
Reply to Group<mailto:broadco[e-mail]?subject=re:%20automic%20v24.4%20and%20compatibility%20with%20java%20openjdk%20jre%20v20> Reply to Sender<https: community.broadcom.com communities all-discussions postreply?messagekey=c54036c2-fa15-40cd-9cf6-019aa7766933&ListKey=7e4de604-f950-4e81-9d19-4e72b8898fb4&SenderKey=22e719b8-55f4-4df2-a61c-a1e2965c750c>
[Jared Kessans]<https: community.broadcom.com network members profile?userkey=22e719b8-55f4-4df2-a61c-a1e2965c750c>
Nov 21, 2025 12:40 PM
Jared Kessans<https: community.broadcom.com network members profile?userkey=22e719b8-55f4-4df2-a61c-a1e2965c750c>

If using PCK.AUTOMIC_CAU_JRE_WINDOWS so that it installs the JRE, how do you handle the certificates? I tried it with a Sandbox agent and it upgrades the agent, installs the JRE, but then get the error "PKIX path building failed: unable to find valid certification path to requested target" and the agent fails to start.

I originally had this agent at 24.4.2 just using the normal agent package PCK.AUTOMIC_CAU_AGENT_WINDOWS. I backed it out to v21.0.14 since that's what we have in all other environments while I determine the upgrade path.

But with the JRE getting installed using PCK.AUTOMIC_CAU_JRE_WINDOWS, it fails due to the certificate.

Do you have to handle the certs differently when using PCK.AUTOMIC_CAU_JRE_WINDOWS?

-------------------------------------------
Reply to Group Online<https: community.broadcom.com communities all-discussions postreply?messagekey=c54036c2-fa15-40cd-9cf6-019aa7766933&ListKey=7e4de604-f950-4e81-9d19-4e72b8898fb4> Reply to Group via Email<mailto:broadco[e-mail]?subject=re:%20automic%20v24.4%20and%20compatibility%20with%20java%20openjdk%20jre%20v20> View Thread<https: community.broadcom.com discussion automic-v244-and-compatibility-with-java-openjdk-jre-v20#bmc54036c2-fa15-40cd-9cf6-019aa7766933> Recommend<https: community.broadcom.com:443 discussion automic-v244-and-compatibility-with-java-openjdk-jre-v20?messagekey=c54036c2-fa15-40cd-9cf6-019aa7766933&cmd=rate&cmdarg=add#bmc54036c2-fa15-40cd-9cf6-019aa7766933> Forward<https: community.broadcom.com communities all-discussions forwardmessages?messagekey=c54036c2-fa15-40cd-9cf6-019aa7766933&ListKey=7e4de604-f950-4e81-9d19-4e72b8898fb4> Flag as Inappropriate<https: community.broadcom.com discussion automic-v244-and-compatibility-with-java-openjdk-jre-v20?markappropriate=c54036c2-fa15-40cd-9cf6-019aa7766933#bmc54036c2-fa15-40cd-9cf6-019aa7766933>