Tomcat fails to start with 11.0.11 (and a downgrade to11.0.9 fixes it), there are various SSL errors apparenty all related to "Cannot decode named group: x25519"
It seems support this it was in fact backported to 11.0.11: https://bugs.openjdk.java.net/browse/JDK-8171279
I couldn't pin-point a single change responsible for it, but essentially we need to upgrade the java.security file to the new version from 11.0.11. I'll run some tests whether it works fine if the updated java.security file is used with the not-yet-updated JRE. Also it looks like we'll need separate templates for Java 8 and 11.
Change 688246 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):
[operations/puppet@production] Manage different templates per Java release branch
Change 688246 merged by Muehlenhoff:
[operations/puppet@production] Manage different templates per Java release branch
Change 688327 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):
[operations/puppet@production] Update java.security file for 11.0.11
Change 688327 merged by Muehlenhoff:
[operations/puppet@production] Update java.security file for 11.0.11
Mentioned in SAL (#wikimedia-operations) [2021-05-18T10:53:21Z] <moritzm> upgrade idp-test to OpenJDK 11.0.11 T281345