diff --git a/java/openjdk8/Makefile b/java/openjdk8/Makefile
--- a/java/openjdk8/Makefile
+++ b/java/openjdk8/Makefile
@@ -88,7 +88,7 @@
 CONFIGURE_SCRIPT=	../../configure
 CONFIGURE_WRKSRC=	${WRKSRC}/common/autoconf
 
-OPTIONS_DEFINE=		ALSA POLICY TZUPDATE X11 FONTCONFIG
+OPTIONS_DEFINE=		ALSA POLICY TZUPDATE X11 FONTCONFIG LOCALBASE_CACERTS
 OPTIONS_DEFINE_armv6=	FPUHACK
 OPTIONS_DEFINE_armv7=	FPUHACK
 OPTIONS_DEFAULT=	ALSA POLICY TZUPDATE X11
@@ -97,6 +97,7 @@
 FPUHACK_DESC=		Hack denormalized numbers in flush-to-zero mode
 POLICY_DESC=		Install the Unlimited Strength Policy Files
 TZUPDATE_DESC=		Update the time zone data
+LOCALBASE_CACERTS_DESC=	Use cacerts from ${LOCALBASE}/etc/ssl instead of bundled one
 
 ALSA_CONFIGURE_ENV_OFF=	ALSA_NOT_NEEDED=yes
 ALSA_CONFIGURE_ON=	--with-alsa=${LOCALBASE}
@@ -298,6 +299,10 @@
 	@${RM} -r ${JRE_IMAGEDIR}/lib/zi
 	@${LN} -sf ${LOCALBASE}/share/java/zi ${JRE_IMAGEDIR}/lib
 
+post-build-LOCALBASE_CACERTS-on:
+	@${RM} ${JRE_IMAGEDIR}/lib/security/cacerts
+	@${LN} -sf ${LOCALBASE}/etc/ssl/cacerts ${JRE_IMAGEDIR}/lib/security/cacerts
+
 do-install:
 	@${MKDIR} ${STAGEDIR}${INSTALLDIR}
 .if !defined(BUILD_JRE)