Importing 4 amazon root Certs from here https://www.amazontrust.com/repository/ into the trust store fixed it for me. -Djavax.net.debug=all, or -Djavax.net.debug=ssl helped to see detailed logs.