One of the root certificates in the cacerts file doesn't pass the jdk's own security tests:

~/jdk/jdk11/bin/keytool -importkeystore -srckeystore src/java.base/share/lib/security/cacerts -srcstorepass changeit -destkeystore /tmp/t1.jks -deststorepass changeit

...
Import command completed: 80 entries successfully imported, 0 entries failed or cancelled

Warning:
<gtecybertrustglobalca [jdk]> uses the MD5withRSA signature algorithm which is considered a security risk.