O JRE falha ao estabelecer a conexão LDAPS com o AD após a importação do certificado RootCA para o armazenamento confiável de cacerts

O LDAPS está funcionando por meio do ldp.exe e de vários outros programas em sistemas Windows e Linux que parecem não exigir o certificado raiz. de forma alguma. Alguns programas que usam JSSE falham ao se conectar após importar a CA raiz e intermediária para o armazenamento confiável cacerts.

Eu testei a importação do certificado LDAPS presente em NTDS\Personal (do AD) diretamente para cacerts e, em certos aplicativos que usam java, isso faz com que o LDAP seguro funcione.

Em programas que usam java e falham, quando o certificado raiz é importado recebo o erro:

[A exceção raiz é javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: Falha na validação do caminho PKIX: java.security.cert.CertPathValidatorException: falha na verificação de assinatura]

If I import the LDAPS certificate sometimes I receive the error:

[Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints]

(even after commenting out java.security)

OR it starts working depending on the program using JRE; however, the common hurdle is that JRE universally doesn't seem to like the certificate chain based on the errors.

MY CDP/AIA are available by HTTP internally and all certificates are signed by a trusted private internal 2 tier Windows PKI.

openssl s_client -connect -showcerts domain:port

Returns the correct certificate chain, but also the error:

verify error:num=20:unable to get local issuer certificate

Which is evidently related to openssl not seeing the root certificate so even with -cafile addendum I get the same error, which may be telling, but the thumbprint in the certificate chain for the root Cert is the same as the -cafile so it would seem it should be right...

At this point I'm starting to think that 70% of all "How-to enable LDAPS with Java" are wrong (they all certainly contradict each-other enough), and that the rules for JAVA CAPS make more sense for why I'm being required to import the actual LDAPS cert rather than just trusting the Root Cert. https://docs.oracle.com/cd/E19509-01/820-3399/ggfrj/index.html

Edit: See answer

So does it sound like a configuration problem with my certificate or does it sound like something else Java specific is going on?