With the same url, this ends up giving a verify return code 20 (unable to get local issuer of certificate):
openssl s_client -connect $URL:443 -showcerts -CAfile /etc/ssl/certs/java/cacerts
This gives a verify return code of 0:
openssl s_client -connect $URL:443 -showcerts -CApath /etc/ssl/certs
... -CAfile /etc/ssl/certs/Thawte_Premium_Server_CA.pem.
But that cert is already in the java keystore. I need to be able to access the url from Java-land and I can't figure out what's going on. I'm a total n00b here so any help would be appreciated.