diff --git a/.pax/pre-packaging.sh b/.pax/pre-packaging.sh
index 90423b117d..a183f1e207 100755
--- a/.pax/pre-packaging.sh
+++ b/.pax/pre-packaging.sh
@@ -192,7 +192,8 @@ BASE_DIR=$(
 
 # use node v16 to build
 export NODE_HOME=/ZOWE/node/node-v16.20.1-os390-s390x
-
+export JAVA_HOME=/ZOWE/node/J17.0_64
+export PATH=$JAVA_HOME/bin:$PATH
 ZOWE_ROOT_DIR="${BASE_DIR}/content"
 
 cd "${BASE_DIR}"
diff --git a/bin/commands/init/certificate/index.sh b/bin/commands/init/certificate/index.sh
index 478b3c745a..a1d2f5c8dd 100644
--- a/bin/commands/init/certificate/index.sh
+++ b/bin/commands/init/certificate/index.sh
@@ -340,7 +340,7 @@ elif [[ "${cert_type}" == JCE*KS ]]; then
   # should we clean up before creating new
   if [ "${ZWE_CLI_PARAMETER_ALLOW_OVERWRITE}" = "true" ]; then
     # warning
-    print_message "Warning ZWEL0300W: Keyring \"safkeyring:///${keyring_owner}/${keyring_name}\" will be overwritten during configuration."
+    print_message "Warning ZWEL0300W: Keyring \"safkeyring://${keyring_owner}/${keyring_name}\" will be overwritten during configuration."
 
     zwecli_inline_execute_command \
       certificate keyring-jcl clean \
@@ -384,7 +384,7 @@ elif [[ "${cert_type}" == JCE*KS ]]; then
       
       yaml_keyring_label="${keyring_label}"
       # keyring string for self-signed CA
-      yaml_pem_cas="safkeyring:////${keyring_owner}/${keyring_name}&${keyring_caLabel}"
+      yaml_pem_cas="safkeyring://${keyring_owner}/${keyring_name}&${keyring_caLabel}"
       ;;
     2)
       # connect existing certs to zowe keyring
@@ -433,9 +433,9 @@ elif [[ "${cert_type}" == JCE*KS ]]; then
       item=$(echo "${item}" | trim)
       if [ -n "${item}" ]; then
         if [ -n "${yaml_pem_cas}" ]; then
-          yaml_pem_cas="${yaml_pem_cas},safkeyring:////${keyring_owner}/${keyring_name}&${item}"
+          yaml_pem_cas="${yaml_pem_cas},safkeyring://${keyring_owner}/${keyring_name}&${item}"
         else
-          yaml_pem_cas="safkeyring:////${keyring_owner}/${keyring_name}&${item}"
+          yaml_pem_cas="safkeyring://${keyring_owner}/${keyring_name}&${item}"
         fi
       fi
     done <<EOF
@@ -447,12 +447,12 @@ EOF
   if [ "${ZWE_CLI_PARAMETER_UPDATE_CONFIG}" = "true" ]; then
     print_level1_message "Update certificate configuration to ${ZWE_CLI_PARAMETER_CONFIG}"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.type" "${cert_type:-JCERACFKS}"
-    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.file" "safkeyring:////${keyring_owner}/${keyring_name}"
+    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.file" "safkeyring://${keyring_owner}/${keyring_name}"
     # we must set a dummy value here, other JDK will complain wrong parameter
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.password" "password"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.keystore.alias" "${yaml_keyring_label}"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.type" "${cert_type:-JCERACFKS}"
-    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.file" "safkeyring:////${keyring_owner}/${keyring_name}"
+    update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.file" "safkeyring://${keyring_owner}/${keyring_name}"
     # we must set a dummy value here, other JDK will complain wrong parameter
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.truststore.password" "password"
     update_zowe_yaml "${ZWE_CLI_PARAMETER_CONFIG}" "zowe.certificate.pem.key" ""
@@ -467,12 +467,12 @@ EOF
     print_message "  certificate:"
     print_message "    keystore:"
     print_message "      type: ${cert_type:-JCERACFKS}"
-    print_message "      file: \"safkeyring:////${keyring_owner}/${keyring_name}\""
+    print_message "      file: \"safkeyring://${keyring_owner}/${keyring_name}\""
     print_message "      password: \"password\""
     print_message "      alias: \"${yaml_keyring_label}\""
     print_message "    truststore:"
     print_message "      type: ${cert_type:-JCERACFKS}"
-    print_message "      file: \"safkeyring:////${keyring_owner}/${keyring_name}\""
+    print_message "      file: \"safkeyring://${keyring_owner}/${keyring_name}\""
     print_message "      password: \"password\""
     print_message "    pem:"
     print_message "      key: \"\""
diff --git a/bin/libs/certificate.sh b/bin/libs/certificate.sh
index 13dec5e1d4..1daf58fd49 100644
--- a/bin/libs/certificate.sh
+++ b/bin/libs/certificate.sh
@@ -28,6 +28,8 @@ ZWE_PRIVATE_DEFAULT_CERTIFICATE_VALIDITY="3650"
 ZWE_PRIVATE_DEFAULT_CERTIFICATE_KEY_USAGE="keyEncipherment,digitalSignature,nonRepudiation,dataEncipherment"
 ZWE_PRIVATE_DEFAULT_CERTIFICATE_EXTENDED_KEY_USAGE="clientAuth,serverAuth"
 
+JAVA_KEYTOOL_FLAG=" -J-Dkeystore.pkcs12.legacy "
+
 #######################################################################
 # Notes: some keyring related functions, like ncert, are using R_datalib behind the scene. It requires proper
 #        permission setup on the server.
@@ -199,8 +201,6 @@ pkcs12_create_certificate_authority() {
   password="${3}"
   common_name=${4:-${ZWE_PRIVATE_DEFAULT_CERTIFICATE_CA_COMMON_NAME}}
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   print_message ">>>> Generate PKCS12 format local CA with alias ${alias}:"
   mkdir -p "${keystore_dir}/${alias}"
   result=$(pkeytool -genkeypair -v \
@@ -212,7 +212,7 @@ pkcs12_create_certificate_authority() {
             -storepass "${password}" \
             -storetype "PKCS12" \
             -validity "${ZWE_PRIVATE_CERTIFICATE_CA_VALIDITY:-${ZWE_PRIVATE_DEFAULT_CERTIFICATE_CA_VALIDITY}}" \
-            ${flags} \
+            ${JAVA_KEYTOOL_FLAG} \
             -ext KeyUsage="keyCertSign" \
             -ext BasicConstraints:"critical=ca:true")
   if [ $? -ne 0 ]; then
@@ -237,11 +237,9 @@ pkcs12_create_certificate_and_sign() {
 
   print_message ">>>> Generate certificate \"${alias}\" in the keystore ${keystore_name}:"
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   mkdir -p "${keystore_dir}/${keystore_name}"
   result=$(pkeytool -genkeypair -v \
-            ${flags} \
+            ${JAVA_KEYTOOL_FLAG} \
             -alias "${alias}" \
             -keyalg RSA -keysize 2048 \
             -keystore "${keystore_dir}/${keystore_name}/${keystore_name}.keystore.p12" \
@@ -259,7 +257,7 @@ pkcs12_create_certificate_and_sign() {
   fi
 
   print_message ">>>> Generate CSR for the certificate \"${alias}\" in the keystore \"${keystore_name}\":"
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -certreq -v \
             -alias "${alias}" \
             -keystore "${keystore_dir}/${keystore_name}/${keystore_name}.keystore.p12" \
@@ -288,7 +286,7 @@ pkcs12_create_certificate_and_sign() {
   san="${san}dns:localhost.localdomain,dns:localhost,ip:127.0.0.1"
 
   print_message ">>>> Sign the CSR using the Certificate Authority \"${ca_alias}\":"
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -gencert -v \
             -infile "${keystore_dir}/${keystore_name}/${alias}.csr" \
             -outfile "${keystore_dir}/${keystore_name}/${alias}.signed.cer" \
@@ -325,7 +323,7 @@ pkcs12_create_certificate_and_sign() {
     >/dev/null 2>/dev/null
   if [ "$?" != "0" ]; then
     print_message ">>>> Import the Certificate Authority \"${ca_alias}\" to the keystore \"${keystore_name}\":"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
               -importcert -v \
               -trustcacerts -noprompt \
               -file "${ca_cert_file}" \
@@ -344,7 +342,7 @@ pkcs12_create_certificate_and_sign() {
     >/dev/null 2>/dev/null
   if [ "$?" != "0" ]; then
     print_message ">>>> Import the Certificate Authority \"${ca_alias}\" to the truststore \"${keystore_name}\":"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
               -importcert -v \
               -trustcacerts -noprompt \
               -file "${ca_cert_file}" \
@@ -360,7 +358,7 @@ pkcs12_create_certificate_and_sign() {
   fi
 
   print_message ">>>> Import the signed CSR to the keystore \"${keystore_name}\":"
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -importcert -v \
             -trustcacerts -noprompt \
             -file "${keystore_dir}/${keystore_name}/${alias}.signed.cer" \
@@ -477,9 +475,7 @@ pkcs12_import_pkcs12_keystore() {
     return 1
   fi
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
-  result=$(pkeytool ${flags} \
+  result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -importkeystore -v \
             -noprompt \
             -deststoretype "PKCS12" \
@@ -508,14 +504,12 @@ pkcs12_import_certificates() {
   ca_files="${3}"
   alias="${4:-extca}"
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   ca_index=1
   while read -r ca_file; do
     ca_file=$(echo "${ca_file}" | trim)
     if [ -n "${ca_file}" ]; then
       print_message ">>>> Import \"${ca_file}\" to the keystore \"${dest_keystore}\":"
-      result=$(pkeytool ${flags} \
+      result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
                 -importcert -v \
                 -trustcacerts -noprompt \
                 -file "${ca_file}" \
@@ -568,8 +562,6 @@ pkcs12_trust_service() {
     return 1
   fi
 
-  flags=$(get_java_pkcs12_keystore_flag)
-
   # parse keytool output into separate files
   csplit -s -k -f "${keystore_dir}/${keystore_name}/${service_alias}" "${tmp_file}" /-----END\ CERTIFICATE-----/1 \
     {$(expr `grep -c -e '-----END CERTIFICATE-----' "${tmp_file}"` - 1)}
@@ -578,7 +570,7 @@ pkcs12_trust_service() {
     cert_file=$(basename "${cert}")
     cert_alias=${cert_file%.cer}
     echo ">>>> Import a certificate \"${cert_alias}\" to the truststore:"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
               -importcert -v \
               -trustcacerts \
               -noprompt \
@@ -633,11 +625,6 @@ pkcs12_export_pem() {
       if [ $? -ne 0 ]; then
         return 1
       fi
-      if [ `uname` = "OS/390" ]; then
-        iconv -f ISO8859-1 -t IBM-1047 "${keystore_dir}/${alias_lc}.cer" > "${keystore_dir}/${alias_lc}.cer-ebcdic"
-        mv "${keystore_dir}/${alias_lc}.cer-ebcdic" "${keystore_dir}/${alias_lc}.cer"
-        ensure_file_encoding "${keystore_dir}/${alias_lc}.cer" "CERTIFICATE"
-      fi
     fi
   done <<EOF
 $(echo "${aliases}")
@@ -1195,12 +1182,11 @@ keyring_export_to_pkcs12() {
 
   print_debug ">>>> Export certificate \"${label}\" from safkeyring:////${keyring_owner}/${keyring_name} to PKCS#12 keystore ${keystore_file}"
 
- flags=$(get_java_pkcs12_keystore_flag)
 
   # create keystore if it doesn't exist
   if [ -f "${keystore_file}" ]; then
     print_debug "- Create keystore with dummy certificate ${dummy_cert}"
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -genkeypair \
             -alias "${dummy_cert}" \
             -dname "CN=Zowe Dummy Cert, OU=ZWELS, O=Zowe, C=US" \
@@ -1237,7 +1223,7 @@ keyring_export_to_pkcs12() {
   if [ "${cert_only}" = "true" ]; then
     # use keytool to import certificate
     print_debug "- Import certificate into keystore as \"${label}\""
-    result=$(pkeytool ${flags} \
+    result=$(pkeytool ${JAVA_KEYTOOL_FLAG} \
             -import -v \
             -trustcacerts -noprompt \
             -alias "${label}" \
diff --git a/bin/libs/java.sh b/bin/libs/java.sh
index 3bf49d3329..da658497bd 100644
--- a/bin/libs/java.sh
+++ b/bin/libs/java.sh
@@ -57,12 +57,12 @@ detect_java_home() {
           break
         fi
       done
-    ) 
+    )
   fi
 
   # fall back to the most well-known java path
-  if [ -z "${java_home}" -a -f /usr/lpp/java/J8.0_64/bin/java ]; then
-    java_home=/usr/lpp/java/J8.0_64
+  if [ -z "${java_home}" -a -f /usr/lpp/java/J17.0_64/bin/java ]; then
+    java_home=/usr/lpp/java/J17.0_64
   fi
 
   if [ -n "${java_home}" ]; then
@@ -132,32 +132,3 @@ validate_java_home() {
 
   print_debug "Java check is successful."
 }
-
-get_java_pkcs12_keystore_flag() {
-  java_version=$("${JAVA_HOME}/bin/java" -version 2>&1) # Capture stderr to stdout, so we can print below if error
-
-
-  # As we know the java -version command works then strip out the line we need
-  java_version_short=$(echo "${java_version}" | grep ^"java version" | sed -e "s/java version //g"| sed -e "s/\"//g")
-  if [[ $java_version_short == "" ]]; then
-    java_version_short=$(echo "${java_version}" | grep ^"openjdk version" | sed -e "s/openjdk version //g"| sed -e "s/\"//g")
-  fi
-  java_major_version=$(echo "${java_version_short}" | cut -d '.' -f 1)
-  java_minor_version=$(echo "${java_version_short}" | cut -d '.' -f 2)
-  java_fix_version=$(echo "${java_version_short}" | cut -d '_' -f 2)
-
-  if [ ${java_major_version} -eq 1 -a ${java_minor_version} -eq 8 ]; then
-    if [ ${java_fix_version} -lt 341 ]; then
-      printf " "
-    elif [ ${java_fix_version} -lt 361 ]; then
-      printf " -J-Dkeystore.pkcs12.certProtectionAlgorithm=PBEWithSHAAnd40BitRC2 -J-Dkeystore.pkcs12.certPbeIterationCount=50000 -J-Dkeystore.pkcs12.keyProtectionAlgorithm=PBEWithSHAAnd3KeyTripleDES -J-Dkeystore.pkcs12.keyPbeIterationCount=50000 "
-    else
-      printf " -J-Dkeystore.pkcs12.legacy "
-    fi
-  elif [ ${java_major_version} -eq 1 -a ${java_minor_version} -gt 8 ]; then
-    printf " -J-Dkeystore.pkcs12.legacy "
-  else
-    printf " "  
-  fi
-}
-
diff --git a/bin/libs/java.ts b/bin/libs/java.ts
index a2a67e55ca..02b9cf2078 100644
--- a/bin/libs/java.ts
+++ b/bin/libs/java.ts
@@ -16,7 +16,7 @@ import * as common from './common';
 import * as shell from './shell';
 import * as config from './config';
 
-const JAVA_MIN_VERSION=8;
+const JAVA_MIN_VERSION=17;
 
 export function ensureJavaIsOnPath(): void {
   let path=std.getenv('PATH') || '/bin:.:/usr/bin';
@@ -48,8 +48,8 @@ export function detectJavaHome(): string|undefined {
     }
   }
 
-  if (!javaBinHome && fs.fileExists('/usr/lpp/java/J8.0_64/bin/java')) {
-    return '/usr/lpp/java/J8.0_64';
+  if (!javaBinHome && fs.fileExists('/usr/lpp/java/J17.0_64/bin/java')) {
+    return '/usr/lpp/java/J17.0_64';
   }
   return undefined;
 }
diff --git a/bin/utils/ExportPrivateKeyZos.java b/bin/utils/ExportPrivateKeyZos.java
index c14cf3bc3f..b2f625807a 100644
--- a/bin/utils/ExportPrivateKeyZos.java
+++ b/bin/utils/ExportPrivateKeyZos.java
@@ -14,7 +14,7 @@
 import java.security.Key;
 import java.security.KeyStore;
 import java.util.Base64;
-import com.ibm.crypto.provider.RACFInputStream;
+import com.ibm.crypto.zsecurity.provider.RACFInputStream;
 
 public class ExportPrivateKeyZos {
     private String keystoreName;
diff --git a/manifest.json.template b/manifest.json.template
index 716d632400..1dc701a564 100644
--- a/manifest.json.template
+++ b/manifest.json.template
@@ -57,27 +57,27 @@
       "artifact": "*.pax"
     },
     "org.zowe.apiml.api-catalog-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "api-catalog-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.discovery-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "discovery-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.gateway-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "gateway-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.caching-service-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "caching-service-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.apiml-common-lib-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "apiml-common-lib-*.zip",
       "exclusions": ["*PR*.zip"]
     },
@@ -87,12 +87,12 @@
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.sdk.apiml-sample-extension-package": {
-      "version": "^2.1.1-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "apiml-sample-extension-*.zip",
       "exclusions": ["*PR*.zip"]
     },
     "org.zowe.apiml.cloud-gateway-package": {
-      "version": "^2.4.4-SNAPSHOT",
+      "version": "^3.0.3-SNAPSHOT",
       "artifact": "cloud-gateway-*.zip",
       "exclusions": ["*PR*.zip"]
     },
@@ -365,23 +365,23 @@
     "api-catalog": {
       "registry": "zowe-docker-snapshot.jfrog.io",
       "name": "ompzowe/api-catalog-services",
-      "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+      "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "caching": {
       "registry": "zowe-docker-snapshot.jfrog.io",
       "name": "ompzowe/caching-service",
-      "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+      "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "discovery": {
       "kind": "statefulset",
       "registry": "zowe-docker-snapshot.jfrog.io",
       "name": "ompzowe/discovery-service",
-      "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+      "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "gateway": {
         "registry": "zowe-docker-snapshot.jfrog.io",
         "name": "ompzowe/gateway-service",
-        "tag" : "2.1.1-SNAPSHOT-ubuntu.v2-x-x"
+        "tag" : "3.0.0-SNAPSHOT-ubuntu.v2-x-x"
     },
     "app-server": {
       "registry": "zowe-docker-snapshot.jfrog.io",
diff --git a/schemas/zowe-yaml-schema.json b/schemas/zowe-yaml-schema.json
index e3867cb09f..f8458baa80 100644
--- a/schemas/zowe-yaml-schema.json
+++ b/schemas/zowe-yaml-schema.json
@@ -748,7 +748,7 @@
             "file": {
               "type": "string",
               "description": "Path of your z/OS keyring, including ring owner and ring name. Case sensitivity and spaces matter.",
-              "pattern": "^safkeyring:\/\/.*"
+              "pattern": "^safkeyring(?:jce(?:cca|hybrid)?)?:\/\/.*"
             },
             "password": {
               "type": "string",
@@ -775,7 +775,7 @@
             "file": {
               "type": "string",
               "description": "Path of your z/OS keyring, including ring owner and ring name. Case sensitivity and spaces matter.",
-              "pattern": "^safkeyring:\/\/.*"
+              "pattern": "^safkeyring(?:jce(?:cca|hybrid)?)?:\/\/.*"
             },
             "password": {
               "type": "string",
diff --git a/tests/installation/src/__tests__/basic/install.ts b/tests/installation/src/__tests__/basic/install.ts
index 9d49eddebb..dc95c8a8f4 100644
--- a/tests/installation/src/__tests__/basic/install.ts
+++ b/tests/installation/src/__tests__/basic/install.ts
@@ -30,6 +30,7 @@ describe(testSuiteName, () => {
       testSuiteName,
       process.env.TEST_SERVER,
       {
+        'zos_java_home': '/ZOWE/node/J17.0_64',
         'zowe_build_local': process.env['ZOWE_BUILD_LOCAL'],
         'zowe_custom_for_test': 'true',
         'zowe_lock_keystore': 'false',
diff --git a/tests/installation/src/utils.ts b/tests/installation/src/utils.ts
index 9b41514184..5bbde80017 100644
--- a/tests/installation/src/utils.ts
+++ b/tests/installation/src/utils.ts
@@ -96,6 +96,9 @@ export function importDefaultExtraVars(extraVars: {[key: string]: any}, serverId
     'zos_node_home'              : ['ZOS_NODE_HOME'],
     'zowe_sanity_test_debug_mode': ['SANITY_TEST_DEBUG'],
   };
+  const globalDefaults: { [key:string] : string } = {
+    'zos_java_home': '/ZOWE/node/J17.0_64'
+  }
   const serverIdSanitized = serverId.replace(/[^A-Za-z0-9]/g, '_').toUpperCase();
   defaultMapping['ansible_ssh_host'].push(`${serverIdSanitized}_SSH_HOST`);
   defaultMapping['ansible_port'].push(`${serverIdSanitized}_SSH_PORT`);
@@ -109,6 +112,13 @@ export function importDefaultExtraVars(extraVars: {[key: string]: any}, serverId
       }
     }
   });
+
+  Object.keys(globalDefaults).forEach((item) => {
+    if (extraVars[item] == null) {
+      extraVars[item] = globalDefaults[item];
+    }
+  })
+
 }
 
 type PlaybookResponse = {
@@ -206,6 +216,8 @@ async function installAndVerifyZowe(testcase: string, installPlaybook: string, s
   debug(`installAndVerifyZowe(${testcase}, ${installPlaybook}, ${serverId}, ${JSON.stringify(extraVars)})`);
 
   debug(`run ${installPlaybook} on ${serverId}`);
+
+
   const resultInstall = await runAnsiblePlaybook(
     testcase,
     installPlaybook,
diff --git a/tests/sanity/test/apiml/test-api-zosmf-via-gateway.js b/tests/sanity/test/apiml/test-api-zosmf-via-gateway.js
index 9ab531ae0c..626665972e 100644
--- a/tests/sanity/test/apiml/test-api-zosmf-via-gateway.js
+++ b/tests/sanity/test/apiml/test-api-zosmf-via-gateway.js
@@ -31,13 +31,13 @@ describe('test api mediation layer zosmf api', function() {
     token = await apiml.login();
   });
 
-  it('should be able to get z/OS Info via the gateway port and endpoint (/api/v1/zosmf/info)', async function() {
+  it('should be able to get z/OS Info via the gateway port and endpoint (/ibmzosmf/api/v1/zosmf/info)', async function() {
     if (!token) {
       this.skip();
     }
 
     const res = await hq.request({
-      url: '/zosmf/api/v1/info',
+      url: '/ibmzosmf/api/v1/zosmf/info',
       method: 'get',
       headers: {
         Cookie: `${APIML_AUTH_COOKIE}=${token}`,
diff --git a/tests/sanity/test/apiml/test-authentication-zosmf-via-gateway.js b/tests/sanity/test/apiml/test-authentication-zosmf-via-gateway.js
index 7939ed0041..6193c279af 100644
--- a/tests/sanity/test/apiml/test-authentication-zosmf-via-gateway.js
+++ b/tests/sanity/test/apiml/test-authentication-zosmf-via-gateway.js
@@ -41,7 +41,7 @@ describe('test api mediation layer zosmf authentication', function() {
     it('with valid basic header', async function() {
       const token = Buffer.from(`${username}:${password}`, 'utf8').toString('base64');
       const res = await hq.request({
-        url: '/zosmf/api/v1/restfiles/ds?dslevel=SYS1.PARMLIB*',
+        url: '/ibmzosmf/api/v1/zosmf/restfiles/ds?dslevel=SYS1.PARMLIB*',
         headers: {
           'Authorization': `Basic ${token}`,
         }
@@ -53,7 +53,7 @@ describe('test api mediation layer zosmf authentication', function() {
     it('with valid cookie', async function() {
       const token = await apiml.login();
       const res = await hq.request({
-        url: '/zosmf/api/v1/restfiles/ds?dslevel=SYS1.PARMLIB*',
+        url: '/ibmzosmf/api/v1/zosmf/restfiles/ds?dslevel=SYS1.PARMLIB*',
         headers: {
           Cookie: `${APIML_AUTH_COOKIE}=${token}`,
         }
@@ -65,7 +65,7 @@ describe('test api mediation layer zosmf authentication', function() {
     it('with valid LTPA cookie', async function() {
       const token = Buffer.from(`${username}:${password}`, 'utf8').toString('base64');
       const loginResponse = await hq.request({
-        url: '/zosmf/api/v1/info',
+        url: '/ibmzosmf/api/v1/zosmf/info',
         headers: {
           'Authorization': `Basic ${token}`,
         }
@@ -73,7 +73,7 @@ describe('test api mediation layer zosmf authentication', function() {
 
       const ltpaCookie = hq.findCookieInResponse(loginResponse, ZOSMF_TOKEN);
       const response = await hq.request({
-        url: '/zosmf/api/v1/info',
+        url: '/ibmzosmf/api/v1/zosmf/info',
         headers: {
           'Cookie': ltpaCookie,
         }
@@ -85,7 +85,7 @@ describe('test api mediation layer zosmf authentication', function() {
     it('with valid JWT token via Bearer', async function() {
       const token = await apiml.login();
       const res = await hq.request({
-        url: '/zosmf/api/v1/restfiles/ds?dslevel=SYS1.PARMLIB*',
+        url: '/ibmzosmf/api/v1/zosmf/restfiles/ds?dslevel=SYS1.PARMLIB*',
         headers: {
           'Authorization': `Bearer ${token}`,
         }
diff --git a/tests/sanity/test/apiml/test-oidc-via-gateway.js b/tests/sanity/test/apiml/test-oidc-via-gateway.js
index 653932440e..193e1164a0 100644
--- a/tests/sanity/test/apiml/test-oidc-via-gateway.js
+++ b/tests/sanity/test/apiml/test-oidc-via-gateway.js
@@ -28,9 +28,9 @@ describe('test oidc mapping via gateway', function() {
     if (!token) {
       this.skip();
     }
-    
+
     const res = await hq.request({
-      url: `zosmf/api/v1/restjobs/jobs?owner=${process.env.SSH_USER.toUpperCase()}&prefix=*`,
+      url: `ibmzosmf/api/v1/zosmf/restjobs/jobs?owner=${process.env.SSH_USER.toUpperCase()}&prefix=*`,
       headers: {
         Cookie: `${APIML_AUTH_COOKIE}=${token}`,
         'X-CSRF-ZOSMF-HEADER': '*',
diff --git a/tests/sanity/test/apiml/test-zss-via-gateway.js b/tests/sanity/test/apiml/test-zss-via-gateway.js
index cd533e1bdd..7a2a6a35ac 100644
--- a/tests/sanity/test/apiml/test-zss-via-gateway.js
+++ b/tests/sanity/test/apiml/test-zss-via-gateway.js
@@ -30,7 +30,7 @@ describe('test zss x509 certificate mapping via gateway', function() {
     }
 
     const res = await hq.request({
-      url: `zosmf/api/v1/restjobs/jobs?owner=${process.env.SSH_USER.toUpperCase()}&prefix=*`,
+      url: `ibmzosmf/api/v1/zosmf/restjobs/jobs?owner=${process.env.SSH_USER.toUpperCase()}&prefix=*`,
       headers: {
         Cookie: `${APIML_AUTH_COOKIE}=${token}`,
         'X-CSRF-ZOSMF-HEADER': '*',
diff --git a/tests/sanity/test/http-helper.js b/tests/sanity/test/http-helper.js
index a857869c82..2a7762740e 100644
--- a/tests/sanity/test/http-helper.js
+++ b/tests/sanity/test/http-helper.js
@@ -323,7 +323,7 @@ class APIMLAuth {
     debug('================================= APIMLAuth.isLoggedIn');
 
     const res = await this.httpRequest.request({
-      url: '/zosmf/api/v1/restfiles/ds?dslevel=SYS1.PARMLIB*',
+      url: '/ibmzosmf/api/v1/zosmf/restfiles/ds?dslevel=SYS1.PARMLIB*',
       headers: {
         ...headers,
         'X-CSRF-ZOSMF-HEADER': '*',
diff --git a/tests/sanity/test/install/test-installed-files.js b/tests/sanity/test/install/test-installed-files.js
index d29f6a5324..d940029edb 100644
--- a/tests/sanity/test/install/test-installed-files.js
+++ b/tests/sanity/test/install/test-installed-files.js
@@ -42,7 +42,7 @@ describe('verify installed files', function() {
 
   it('fingerprint should match', async function() {
     // IMPORT: After 'source' the profile, JAVA_HOME environment variable must exist
-    const fingerprintStdout = await sshHelper.executeCommandWithNoError(`touch ~/.profile && . ~/.profile && ${process.env.ZOWE_ROOT_DIR}/bin/zwe support verify-fingerprints`);
+    const fingerprintStdout = await sshHelper.executeCommandWithNoError(`touch ~/.profile && . ~/.profile && ${process.env.ZOWE_ROOT_DIR}/bin/zwe support verify-fingerprints --config /ZOWE/tmp/.zowe/zowe.yaml`);
     debug('fingerprint show result:', fingerprintStdout);
     addContext(this, {
       title: 'fingerprint show result',
diff --git a/workflows/files/ZWESIGNC.properties b/workflows/files/ZWESIGNC.properties
index 5ffef27145..8a0f6a504b 100644
--- a/workflows/files/ZWESIGNC.properties
+++ b/workflows/files/ZWESIGNC.properties
@@ -44,4 +44,4 @@ validity=3650
 # Category: General
 # Description:
 #  JAVA home location
-JAVA_HOME=/sys/java64bt/v8r0m0/usr/lpp/java/J8.0_64
+JAVA_HOME=/sys/java64bt/v17r0m0/usr/lpp/java/J17.0_64
diff --git a/workflows/files/ZWESIGNC.xml b/workflows/files/ZWESIGNC.xml
index 7cc8bec1e5..258078600a 100644
--- a/workflows/files/ZWESIGNC.xml
+++ b/workflows/files/ZWESIGNC.xml
@@ -63,7 +63,7 @@
         <category>General</category>
         <string valueMustBeChoice="false" multiLine="false">
             <regularExpression>^\/.{0,50}[^\/]$</regularExpression>
-            <default>/sys/java64bt/v8r0m0/usr/lpp/java/J8.0_64</default>
+            <default>/sys/java64bt/v17r0m0/usr/lpp/java/J17.0_64</default>
         </string>
     </variable>
     <step name="define_variables" optional="false">