Java is installed by Salt.
New JVM editions will include an updated cacerts file, and the certificates used for interserver authentication. The default JVM cacerts password is "changeit".
keytool -import -trustcacerts -alias "commonidtrust-root" -file /path/to/newcacert.pem -keystore /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.19.x86_64/jre/lib/security/cacerts}}