---
title: Before you add new servers
description: Prerequisites before upgrading PingDS by adding new servers, including Java requirements and certificate authority readiness.
component: pingds
version: 8
page_id: pingds:upgrade-guide:before-you-upgrade
canonical_url: https://docs.pingidentity.com/pingds/8.1/upgrade-guide/before-you-upgrade.html
llms_txt: https://docs.pingidentity.com/pingds/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2024-09-24T12:48:16Z
keywords: ["Compatibility", "LDAP", "Upgrade"]
superseded_by: https://docs.pingidentity.com/pingds/8.1/upgrade-guide/before-you-upgrade.html
section_ids:
  supported_java: Supported Java
  upgrade-generated-cas-add: CAs from deployment IDs
  next_steps: Next steps
---

# Before you add new servers

Fulfill these requirements before upgrading PingDS software, especially before upgrading the software in a production environment. Also review the requirements listed in the [release notes](https://docs.pingidentity.com/pingds/release-notes/requirements.html).

## Supported Java

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | * Always use a JVM with the latest security fixes.

* Make sure you have a supported Java environment installed on the system.

  If your default Java environment is not appropriate, use one of the following solutions:

  * Edit the `default.java-home` setting in the `opendj/config/java.properties` file.

  * Set `OPENDJ_JAVA_HOME` to the path to the correct Java environment.

  * Set `OPENDJ_JAVA_BIN` to the absolute path of the `java` command.

* When running the `dskeymgr` and `setup` commands, use the same Java environment everywhere in the deployment and refer to [CAs from deployment IDs](#upgrade-generated-cas-add). |

DS software supports the following Java environments:

| Vendor                                                                                                                                                                                                                                                                  | Versions  |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| OpenJDK, including OpenJDK-based distributions:- AdoptOpenJDK/Eclipse Temurin Java Development Kit (Adoptium)

- Amazon Corretto

- Azul Zulu

- Red Hat OpenJDKPing Identity tests most extensively with AdoptOpenJDK/Eclipse Temurin.Use the HotSpot JVM if possible. | 21, 25(1) |
| Oracle Java                                                                                                                                                                                                                                                             | 21, 25(1) |

(1) DS supports Java 25 from 8.0.1. DS 8.0.0 supports only Java 21.

TLS cipher support depends solely on the JVM. Learn more in [TLS settings](../security-guide/connections.html#tls-protocols-cipher-suites).

## CAs from deployment IDs

Due to a change to the Java platform between versions 11 and 17, the key pairs you generate with the `dskeymgr` and `setup` commands using Java 11 are incompatible with keys generated using Java 17 and later.

|   |                                                                                                                                                                                                                                           |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Running DS servers with incompatible Java versions is a problem when you use deployment ID-based CA certificates.If you [use your own CA](../install-guide/setup-own-keys.html), not one derived from a deployment ID, skip this section. |

Replication breaks, for example, when you use the `setup` command for a new server with a more recent version of Java than was used to set up existing servers.

Find troubleshooting suggestions in [Overcome incompatible Java versions when adding new servers](../maintenance-guide/troubleshooting.html#troubleshoot-incompatible-java-versions-add-server).

## Next steps

* [icon: check-square-o, set=fa]Perform [these steps](before-you-upgrade.html) before you add servers

* [icon: square-o, set=fa]*Add new servers:*

  * [icon: square-o, set=fa]Follow [these instructions](add-new-servers.html) unless upgrading from DS 7.4.0

  * [icon: square-o, set=fa]Follow [these instructions](from-740.html) when upgrading from DS 7.4.0

* [icon: square-o, set=fa]Perform [these steps](after-you-upgrade.html) after you finish adding servers