Oracle asks to see your Java deployments before it will sell you more subscriptions. Why Java is the hardest thing in your environment to count, what the employee-based subscription changed, and how to build a deployment record you can actually defend.
Certero saw a marked increase in Oracle’s interest in customers’ Java deployments, particularly where an organisation was looking to buy additional subscriptions. In 2019 Oracle began charging commercial users of Java under a subscription model for versions released after 16 April 2019. Things then went quiet, and Java audit activity fell away through the pandemic. It came back, and the pattern was consistent: before Oracle would process an order for more subscriptions, it wanted a list of the customer’s Java deployments.
If you are being asked for that list, there are a few things worth thinking about before you produce one.
This post was published in February 2022. In January 2023 Oracle replaced the per-user and per-processor Java SE subscriptions with the Java SE Universal Subscription, which is sold on an employee-based metric. “Employee” is defined broadly — it counts your full-time, part-time, temporary and seasonal staff, plus contractors, consultants and outsourcers supporting internal operations, regardless of whether any of them touch Java.
That change does not make the visibility problem smaller. It makes it sharper. Under the old metric, counting deployments told you what to buy. Under the employee metric, counting deployments tells you something more valuable: whether you need a commercial subscription at all, and what it would take to get to a position where you do not. Every host you can move to a non-Oracle build, retire, or show is covered by another entitlement is a host that no longer pulls you into the commercial metric. You cannot make any of those arguments without an accurate record of where Java is.
The rest of this post is about building that record.
Imagine the scenario. One of your team contacts you to say “we need to buy some Oracle Java subscriptions.” Your first questions are the obvious ones: how many, how much, and for what?
The answer comes back as an estimate. We have roughly three thousand employees and somewhere around a hundred and fifty servers, so let’s cover that and it should do.
But Oracle wants to know what your Java footprint looks like before you can proceed. So you go back to your colleague and ask where all the Oracle Java deployments are — the hosts, the versions, the users. Your colleague is puzzled. How is anyone supposed to find all that?
It is a fair question.
Java has been around long enough that it is probably everywhere. Developers use it, so it turns up inside in-house and third-party applications. It arrives bundled with other licensable products from IBM and SAP, and sometimes with other Oracle licensing. Most organisations have Java in their build images, so it is rolled out with every machine refresh and every new starter. It is a continuous merry-go-round of deployment with an unusually wide array of mechanisms behind it.
And Java is not one thing. Oracle JDK, OpenJDK, the IBM and SAP redistributions, Amazon Corretto, Eclipse Temurin and the rest are all “Java” to the person who installed them. Only some of them create an Oracle liability. Telling them apart is most of the work.
The first step is full visibility. Not a survey, not a sample, and not a script you run once and archive.
CerteroX ITAM discovers and inventories the hosts, and CerteroX SAM recognises what is installed on them. Software recognition resolves against the Software Recognition Database — over 3.5 million normalised publisher, product and version titles — so a Java installation is identified as the specific distribution and version it actually is, rather than a folder name someone has to interpret.
That gets you:
Coverage matters here more than it does for most publishers. Java runs on the platforms that ordinarily get left out of an inventory, so the native agent covers six operating system families — Windows, macOS, Linux, IBM AIX, HP-UX and Oracle Solaris — with the same inventory cycle and the same licence engine on all six. If your discovery only reaches Windows, your Java answer is wrong before you start.
This work is evidence-based. It is not a set of assumptions, and it is not a script whose output you have to take on faith. The underlying data stays there for you to investigate and check yourself, host by host.
That distinction has a practical consequence in an audit. Certero is a verified third-party tool vendor with Oracle License Management Services. In Certero’s published wording: being a verified third-party toolset means that Oracle’s audit team can accept data from Certero during an official audit, as an alternative to installing Oracle License Management measurement tools. That is a conditional rather than a guarantee, but it is a materially better starting position than handing over a spreadsheet somebody assembled by hand.
The analysis then gives you a position on the whole footprint, not just a list — what it would cost to license what you have today, what the trajectory looks like, and which portion is legacy or non-Oracle and therefore addressable. It sits in a dashboard that keeps itself current, so the answer is available when you are asked rather than reconstructed each time.
Producing the list Oracle asked for is the smallest reason to do this.
The larger reason is that Java is one of the most awkward areas of subscription licensing there is, and the only way to get control of it is to know exactly what you have. That means understanding what a subscription actually covers, ring-fencing the legacy installations and the non-Oracle distributions, removing the unsupported versions that are a security exposure in their own right, and planning what your Java position should look like in two years rather than reacting to what it is today.
Under the employee metric, that planning is the whole game. The organisations that come out of this well are the ones that knew where their Java was before anyone asked.
Other posts covering the same ground.
SAM is usually sold as audit insurance. It is also a security control, a cost-reduction programme, due diligence for an acquisition, and the only reliable basis for rationalising your applications.
What an audit actually is, how it differs from a SAM review, what triggers one, and what you can do about it once the letter has arrived — including whether a completed audit can still be challenged.
Microsoft bundled Office 365, Windows 10 Enterprise and Enterprise Mobility + Security into a single SKU in late 2016. The bundle has been renamed twice since, and the licensing problem it created has not changed at all.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.