Quality Outreach Heads-up - JDK 28: jlink cacerts plugin

The OpenJDK Quality Group is promoting the testing of FOSS projects with OpenJDK builds as a way to improve the overall quality of the release. This heads-up is part of a Quality Outreach update sent to the projects involved. To learn more about the program, and how-to join, please check here.

A new jlink plugin has been added which allows the user to specify the specific CA certificates be to included in the cacerts keystore in a custom runtime image. This is very useful for creating runtimes that only contain the CA certificates that are needed by application(s) which will be using that custom runtime. The command-line syntax takes one or more cacerts keystore aliases as an option, separated by a comma.

For example:

jlink --cacerts "letsencryptisrgx1 [jdk]"

or

jlink --cacerts "letsencryptisrgx1 [jdk],digicertglobalrootca [jdk]"

For more information, please check JDK-8377102.