Thought;
Why is there not much support behind the open and free CA "CACert" that has been around much longer then Let's Encrypt?

So.. I spent some non-trivial time trying to call a soap service via SSL in a java application struggling with SSLHandhakeException. I tried quite a few things with the certificates, none of them worked.. until we found out, that I added the right certificates to the truststore of the WRONG java :-/

Conclusion: when working with java cacert files, run
echo %java_home%
first (you can thank me later).