diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec
index e4da2da..a1153c8 100644
--- a/java-latest-openjdk-portable.spec
+++ b/java-latest-openjdk-portable.spec
@@ -391,7 +391,7 @@
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        9
-%global rpmrelease      2
+%global rpmrelease      3
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@@ -1139,7 +1139,6 @@ function buildjdk() {
 %ifarch %{ppc64le}
     --with-jobs=1 \
 %endif
-    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
     --with-version-build=%{buildver} \
     --with-version-pre="%{ea_designator}" \
     --with-version-opt=%{lts_designator} \
@@ -1627,6 +1626,10 @@ done
 %license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}}
 
 %changelog
+* Mon May 15 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.1.0.9-3.rolling
+- no longer using system cacerts during build
+- they are already mv-ed as .upstream in rpms
+
 * Wed May 10 2023 Jiri Vanek <gnu.andrew@redhat.com> - 1:20.0.1.0.9-2.rolling
 - enabled all crypto