Compromised Certificates and OpenJDK Java Runtimes

OpenJDK published guidance after the private keys of eight eMudhra intermediate CA certificates were reported compromised. Standalone runtimes should be updated to a release citing JDK-8395690, or else have four root certificates (three emSign roots and comodoaaaca) deleted from the cacerts keystore, or have revocation checking enabled. A CheckCerts.java tool tests exposure. Most Linux packages follow OS certificate updates, while Debian-based systems need the keystore rebuilt by hand because of a known bug. FreeBSD and Homebrew need package updates. Several of these distribution details were not independently verified.