How to Install OpenJDK 17 on Debian 13, 12 and 11

Java 17 still anchors Spring Boot 3.x, Jakarta EE 10, Jenkins, Gradle, and many enterprise build pipelines even after newer Java LTS branches arrived. To install OpenJDK 17 on Debian, use Debian’s default packages on Debian 12 (Bookworm) or Debian 11 (Bullseye); on Debian 13 (Trixie), use Eclipse Temurin from Adoptium because Trixie no longer ships the openjdk-17-jdk package.

The package source matters because update and removal commands differ. Debian packages use openjdk-17-jdk or openjdk-17-jre, while Adoptium packages use temurin-17-jdk or temurin-17-jre. After installation, verify java and javac, switch runtimes with update-alternatives, set JAVA_HOME only when a tool expects it, and remove the matching package source later.

Install OpenJDK 17 on Debian

Two installation paths matter for Debian users who need Java 17 today:

Method	Source	Version	Updates	Best For
Debian APT	Debian repositories	17.0.x	Through Debian APT	Debian 12 and Debian 11 users who want Debian-packaged OpenJDK 17 with no external repository
Eclipse Temurin	Adoptium repository	17.0.x	Through Adoptium APT	Debian 13 users, or anyone who wants the same OpenJDK 17 package line across Debian 13, 12, and 11

Debian 12 Bookworm and Debian 11 Bullseye still publish openjdk-17-jdk in the default repositories. Debian 13 Trixie does not, so the Temurin repository is the direct OpenJDK 17 path there. Manual Adoptium DEB822 setup keeps the repository file and key path consistent across Debian 13, 12, and 11.

OpenJDK 17 remains a practical LTS baseline for existing applications. The Temurin support roadmap lists Java 17 availability through at least October 2027, while Debian packages receive updates through Debian’s own security channels for the releases that carry the package.

If you previously enabled Temurin with extrepo, remove that source before using the manual Adoptium repository. The extrepo entry and the manual adoptium.sources file point to the same APT repository with different Signed-By paths, and APT stops with a conflict error until one source is removed.

Use the explicit package names when you need Java 17. On current Debian releases, default-jdk maps to OpenJDK 21 on Debian 13, OpenJDK 17 on Debian 12, and OpenJDK 11 on Debian 11.

Update Debian Before Installing OpenJDK 17

Refresh APT before installing Java so Debian sees the latest package metadata and security updates:

sudo apt update && sudo apt upgrade

These commands use sudo for tasks that need root privileges. If your account is not in the sudoers file yet, run the commands as root or follow the guide on how to add a user to sudoers on Debian.

Install OpenJDK 17 from Debian Repositories

Use Debian’s own packages on Debian 12 or Debian 11 when you want the distro-maintained OpenJDK 17 build. If you are on Debian 13, use the Temurin repository method instead because Trixie no longer exposes openjdk-17-jdk through the default repositories.

List the available OpenJDK 17 packages first:

apt-cache search ^openjdk-17 | sed -n '1,8p'

Debian 12 and Debian 11 return package names like these:

openjdk-17-dbg - Java runtime based on OpenJDK (debugging symbols)
openjdk-17-demo - Java runtime based on OpenJDK (demos and examples)
openjdk-17-doc - OpenJDK Development Kit (JDK) documentation
openjdk-17-jdk - OpenJDK Development Kit (JDK)
openjdk-17-jdk-headless - OpenJDK Development Kit (JDK) (headless)
openjdk-17-jre - OpenJDK Java runtime, using Hotspot JIT
openjdk-17-jre-headless - OpenJDK Java runtime, using Hotspot JIT (headless)
openjdk-17-jre-zero - Alternative JVM for OpenJDK, using Zero

Choose the package that matches your workload:

• openjdk-17-jre runs Java applications on desktops or servers that do not need a compiler.
• openjdk-17-jdk adds javac and the rest of the development tooling for builds, IDEs, and tools like Apache Maven on Debian.
• openjdk-17-jre-headless strips graphical dependencies for servers, containers, and CI jobs.
• openjdk-17-jdk-headless keeps the compiler and developer tools while dropping GUI libraries for leaner build hosts.

Install the full JDK if you need to compile Java code or build projects:

sudo apt install openjdk-17-jdk

If you only need the runtime, install the JRE instead:

sudo apt install openjdk-17-jre

For servers and container images, swap either package for the matching -headless variant. That trims GUI libraries you do not need on a headless Debian system or while building Docker on Debian.

Verify that the runtime is active:

java --version

Expected output from the Debian 12 package:

openjdk 17.0.19 2026-04-21
OpenJDK Runtime Environment (build 17.0.19+10-1-deb12u2-Debian)
OpenJDK 64-Bit Server VM (build 17.0.19+10-1-deb12u2-Debian, mixed mode, sharing)

Debian 11 currently ships the same upstream OpenJDK 17.0.19 release with a -1-deb11u1-Debian package suffix in the runtime line. The main version number stays the same.

If you installed the JDK, confirm the compiler is available too:

javac --version

javac 17.0.19

To update Debian’s OpenJDK 17 package later without touching unrelated packages, run:

sudo apt update && sudo apt install --only-upgrade openjdk-17-jdk

Install OpenJDK 17 from the Adoptium Repository on Debian

Use the Adoptium repository when you are on Debian 13 or when you want the same Temurin 17 package line across Debian 13, 12, and 11. This path keeps updates inside your normal APT workflow instead of relying on manual tarball installs.

Install the packages needed to add the repository securely:

sudo apt install ca-certificates curl gpg

Import the Adoptium signing key into Debian’s keyring directory:

curl -fsSL https://packages.adoptium.net/artifactory/api/gpg/key/public | sudo gpg --dearmor --yes -o /usr/share/keyrings/adoptium.gpg

Add the Adoptium repository in DEB822 format. This command reads your Debian codename from /etc/os-release and your CPU architecture from dpkg:

printf '%s\n' \
'Types: deb' \
'URIs: https://packages.adoptium.net/artifactory/deb' \
"Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")" \
'Components: main' \
"Architectures: $(dpkg --print-architecture)" \
'Signed-By: /usr/share/keyrings/adoptium.gpg' | sudo tee /etc/apt/sources.list.d/adoptium.sources > /dev/null

Refresh APT so Debian downloads the new package index:

sudo apt update

APT should show the new Adoptium source in the update output:

Get:4 https://packages.adoptium.net/artifactory/deb [your-release] InRelease [7,503 B]
Get:5 https://packages.adoptium.net/artifactory/deb [your-release]/main amd64 Packages [10.9 kB]
Reading package lists...

Replace [your-release] with your Debian codename. Debian 13 shows trixie, Debian 12 shows bookworm, and Debian 11 shows bullseye.

Confirm that APT can see Temurin 17 before you install it:

apt-cache policy temurin-17-jdk

Expected output:

temurin-17-jdk:
  Installed: (none)
  Candidate: 17.0.19.0.0+10-1
  Version table:
     17.0.19.0.0+10-1 500
        500 https://packages.adoptium.net/artifactory/deb [your-release]/main amd64 Packages

The package revision changes as Adoptium publishes updates. Your output should show the current Temurin 17 package and your Debian codename, such as trixie, bookworm, or bullseye.

Install the full Temurin 17 JDK:

sudo apt install temurin-17-jdk

The install pulls in the Temurin JDK and Adoptium’s certificate bundle:

The following NEW packages will be installed:
  adoptium-ca-certificates java-common temurin-17-jdk

Setting up adoptium-ca-certificates (1.0.x-1) ...
Setting up temurin-17-jdk (17.0.19.0.0+10-1) ...

If you only need the runtime, use sudo apt install temurin-17-jre instead. Adoptium publishes both the JDK and JRE packages for Debian 13, 12, and 11.

Check which Java runtime is active after the install:

java --version

If Temurin 17 already owns the active java alternative, you will see output like this:

openjdk 17.0.19 2026-04-21
OpenJDK Runtime Environment Temurin-17.0.19+10 (build 17.0.19+10)
OpenJDK 64-Bit Server VM Temurin-17.0.19+10 (build 17.0.19+10, mixed mode, sharing)

If java --version still shows OpenJDK 21 or 25, Temurin 17 is installed but a newer JDK still has higher update-alternatives priority. That is normal. Use the alternatives section to switch Java 17 into place before you set JAVA_HOME.

If java --version already reports Java 17, confirm the compiler too:

javac --version

javac 17.0.19

To update only Temurin 17 later, refresh APT and upgrade that package directly:

sudo apt update && sudo apt install --only-upgrade temurin-17-jdk

Manage OpenJDK 17 on Debian

Java version management matters on Debian because multiple JDKs can coexist. Debian’s alternatives system decides which java and javac binaries your shell uses.

Switch the Active Java Runtime for OpenJDK 17 on Debian

If java --version still points to another release after you install OpenJDK 17, list the available alternatives:

sudo update-alternatives --config java

Debian prints a menu like this when multiple JDKs are installed:

There are 3 choices for the alternative java (providing /usr/bin/java).

  Selection    Path                                         Priority   Status
------------------------------------------------------------
  0            /usr/lib/jvm/temurin-25-jdk-amd64/bin/java    2511      auto mode
  1            /usr/lib/jvm/java-17-openjdk-amd64/bin/java   1711      manual mode
* 2            /usr/lib/jvm/temurin-17-jdk-amd64/bin/java    1711      manual mode
  3            /usr/lib/jvm/temurin-25-jdk-amd64/bin/java    2511      manual mode

Press <enter> to keep the current choice[*], or type selection number:

Select the entry ending in java-17-openjdk or temurin-17-jdk, then align the compiler with the same version:

sudo update-alternatives --config javac

Finish by checking both commands again:

java --version
javac --version

Both commands should now report Java 17:

openjdk 17.0.19 2026-04-21
OpenJDK Runtime Environment (build 17.0.19+10-...)
OpenJDK 64-Bit Server VM (build 17.0.19+10-..., mixed mode, sharing)
javac 17.0.19

Debian packages show a Debian build suffix in the runtime line, while Temurin adds a Temurin-17.0.19+10 build string. The important part is that both commands report Java 17.

Find the JAVA_HOME Path for OpenJDK 17 on Debian

For Debian’s OpenJDK 17 package on amd64, the JDK path is usually /usr/lib/jvm/java-17-openjdk-amd64. Temurin 17 uses /usr/lib/jvm/temurin-17-jdk-amd64 on the same architecture. Switch Java 17 into place first, then detect the active path before exporting JAVA_HOME:

dirname "$(dirname "$(readlink -f "$(command -v java)")")"

Example output from Debian’s OpenJDK 17 package:

/usr/lib/jvm/java-17-openjdk-amd64

On ARM64 systems, Debian and Temurin both end the directory name with -arm64 instead of -amd64. Use the detection command instead of hard-coding a path when scripts may run on different architectures.

Store the detected path in your shell profile and reload it. This command replaces an existing JAVA_HOME export instead of appending duplicates:

JAVA_HOME_PATH=$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")
if grep -q '^export JAVA_HOME=' ~/.bashrc; then
  sed -i "s|^export JAVA_HOME=.*|export JAVA_HOME=${JAVA_HOME_PATH}|" ~/.bashrc
else
  echo "export JAVA_HOME=${JAVA_HOME_PATH}" >> ~/.bashrc
fi
source ~/.bashrc

Verify that the variable points to the JDK you selected:

echo $JAVA_HOME

/usr/lib/jvm/java-17-openjdk-amd64

Test OpenJDK 17 with a Sample Java Program on Debian

A quick compile-and-run test proves that the runtime and compiler both work before you move on to a real project.

Create a Test Program for OpenJDK 17

Create a new file in your home directory:

nano ~/HelloOpenJDK17.java

Paste in this minimal Java program, save the file, and exit the editor:

public class HelloOpenJDK17 {
    public static void main(String[] args) {
        System.out.println("Hello from OpenJDK 17 on Debian!");
    }
}

Compile and Run the OpenJDK 17 Test Program

Compile the source file and run the class file that javac generates:

javac ~/HelloOpenJDK17.java && java -cp ~ HelloOpenJDK17

Expected output:

Hello from OpenJDK 17 on Debian!

Troubleshoot OpenJDK 17 on Debian

These are the two Debian-specific problems most likely to block an OpenJDK 17 installation.

Fix “Unable to Locate Package openjdk-17-jdk” on Debian 13

If you run the Debian APT method on Debian 13, APT currently returns this error:

Reading package lists...
Building dependency tree...
Reading state information...
Error: Unable to locate package openjdk-17-jdk

Check which OpenJDK packages your Debian release actually exposes:

apt-cache search ^openjdk | sed -n '1,12p'

On Debian 13 Trixie, the first results look like this:

openjdk-21-dbg - Java runtime based on OpenJDK (debugging symbols)
openjdk-21-demo - Java runtime based on OpenJDK (demos and examples)
openjdk-21-doc - OpenJDK Development Kit (JDK) documentation
openjdk-21-jdk - OpenJDK Development Kit (JDK)
openjdk-21-jdk-headless - OpenJDK Development Kit (JDK) (headless)
openjdk-21-jre - OpenJDK Java runtime, using Hotspot JIT
openjdk-25-dbg - Java runtime based on OpenJDK (debugging symbols)
openjdk-25-demo - Java runtime based on OpenJDK (demos and examples)
openjdk-25-doc - OpenJDK Development Kit (JDK) documentation
openjdk-25-jdk - OpenJDK Development Kit (JDK)

If your output shows OpenJDK 21 and 25 but not 17, switch to the Temurin repository method in the installation section. Debian 12 and Debian 11 still publish openjdk-17-jdk through the default repositories, so this error is mainly a Debian 13 issue.

Fix the Wrong Java Version After Installing OpenJDK 17

If java --version still reports another release, a higher-priority JDK is still active. A common example is Temurin 25 remaining selected:

openjdk 25.0.3 2026-04-21 LTS
OpenJDK Runtime Environment Temurin-25.0.3+9 (build 25.0.3+9-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.3+9 (build 25.0.3+9-LTS, mixed mode, sharing)

List the available runtime and compiler choices, then switch both entries to the Java 17 path you installed:

sudo update-alternatives --config java
sudo update-alternatives --config javac

Choose the entry ending in java-17-openjdk or temurin-17-jdk, then confirm the change with java --version and javac --version.

Fix Signed-By Conflicts from an Earlier extrepo Temurin Setup

If apt update fails right after you add the manual Adoptium repository, an older extrepo Temurin source is usually still present on the system.

Error: Conflicting values set for option Signed-By regarding source https://packages.adoptium.net/artifactory/deb/ trixie: /usr/share/keyrings/adoptium.gpg != /var/lib/extrepo/keys/temurin.asc
Error: The list of sources could not be read.

Remove the old extrepo source files if you want to keep the manual Adoptium configuration:

sudo extrepo disable temurin
sudo rm -f /etc/apt/sources.list.d/extrepo_temurin.sources
sudo rm -f /var/lib/extrepo/keys/temurin.asc
sudo apt update

APT should refresh normally again and keep the manual Adoptium source:

Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://security.debian.org/debian-security trixie-security InRelease
Get:3 https://packages.adoptium.net/artifactory/deb trixie InRelease [7,503 B]
Reading package lists...

Remove OpenJDK 17 from Debian

Use the removal path that matches the package source you installed. The Debian APT and Temurin packages can coexist with newer Java releases, so removing Java 17 often leaves another JDK active.

When APT proposes an autoremove transaction, review the package list before confirming it. Long-lived systems can already have unrelated autoremovable packages.

Remove the Debian-Packaged OpenJDK 17 Build

Remove the Debian repository packages and then clear unused dependencies:

sudo apt remove openjdk-17-jdk openjdk-17-jdk-headless openjdk-17-jre openjdk-17-jre-headless
sudo apt autoremove

Confirm that the Debian package is no longer installed:

apt-cache policy openjdk-17-jdk

openjdk-17-jdk:
  Installed: (none)
  Candidate: 17.0.x
  Version table:
     17.0.x 500
        500 http://security.debian.org/debian-security [your-release]-security/main amd64 Packages

Replace [your-release] with your Debian security suite. Debian 12 shows bookworm and Debian 11 shows bullseye. Debian 13 does not offer openjdk-17-jdk in the default repositories, so Trixie returns no candidate here.

The Installed: (none) line confirms the Debian package is gone. If another JDK remains on the system, java --version switches to that version instead of returning command not found.

Remove Temurin 17 and the Adoptium Repository

Remove the Temurin 17 package first. If you installed the runtime-only package, replace temurin-17-jdk with temurin-17-jre:

sudo apt remove temurin-17-jdk
sudo apt autoremove

Only remove the Adoptium repository if you are not keeping any other Temurin packages such as Temurin 21 or Temurin 25. If another Adoptium JDK is still installed, leave the repository and key in place.

If you are finished with Adoptium packages entirely, remove the repository file and signing key, then refresh APT:

sudo rm -f /etc/apt/sources.list.d/adoptium.sources
sudo rm -f /usr/share/keyrings/adoptium.gpg
sudo apt update

After removing both the package and the repository, verify that APT no longer knows about Temurin 17:

apt-cache show temurin-17-jdk

E: No packages found

Conclusion

OpenJDK 17 on Debian is now set up with a clear path to switch runtimes, set JAVA_HOME, and verify your compiler before you move into a real project. If you are building Java applications next, add Apache Maven on Debian for dependency management, or compare it with OpenJDK 25 on Debian when a newer LTS release fits better.