diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index e3d2fe5..c5bb0e8 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -4,7 +4,6 @@
 # Example:
 # When used from local repo set REPO_ROOT pointing to file:// with your repo
 # If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL
-# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable
 #
 # In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
 # PROJECT_NAME=openjdk
@@ -41,6 +40,7 @@ if [ "x$1" = "xhelp" ] ; then
     echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})"
     echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})"
     echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
+    echo "REPO_ROOT - the location of the Git repository to archive (optional; defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)"
     echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
     echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run"
     exit 1;
@@ -121,6 +121,17 @@ if [ "x$TO_COMPRESS" = "x" ] ; then
     echo "No targets to be compressed specified, ; default to ${TO_COMPRESS}"
 fi;
 
+echo -e "Settings:"
+echo -e "\tVERSION: ${VERSION}"
+echo -e "\tPROJECT_NAME: ${PROJECT_NAME}"
+echo -e "\tREPO_NAME: ${REPO_NAME}"
+echo -e "\tOPENJDK_URL: ${OPENJDK_URL}"
+echo -e "\tCOMPRESSION: ${COMPRESSION}"
+echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
+echo -e "\tREPO_ROOT: ${REPO_ROOT}"
+echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
+echo -e "\tBOOT_JDK: ${BOOT_JDK}"
+
 if [ -d ${FILE_NAME_ROOT} ] ; then
   echo "exists exists exists exists exists exists exists "
   echo "reusing reusing reusing reusing reusing reusing "
diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec
index e4da2da..a1153c8 100644
--- a/java-latest-openjdk-portable.spec
+++ b/java-latest-openjdk-portable.spec
@@ -391,7 +391,7 @@
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        9
-%global rpmrelease      2
+%global rpmrelease      3
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@@ -1139,7 +1139,6 @@ function buildjdk() {
 %ifarch %{ppc64le}
     --with-jobs=1 \
 %endif
-    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
     --with-version-build=%{buildver} \
     --with-version-pre="%{ea_designator}" \
     --with-version-opt=%{lts_designator} \
@@ -1627,6 +1626,10 @@ done
 %license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}}
 
 %changelog
+* Mon May 15 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.1.0.9-3.rolling
+- no longer using system cacerts during build
+- they are already mv-ed as .upstream in rpms
+
 * Wed May 10 2023 Jiri Vanek <gnu.andrew@redhat.com> - 1:20.0.1.0.9-2.rolling
 - enabled all crypto