OpenJDK tickets JDK-8157272 and JDK-8157411, added to JDK 8u111, add the root certificates used by Let's Encrypt to the cacerts file. Please add these root CAs to the FreeBSD openjdk 8 package so that certificates signed by Let's Encrypt will be recognized without needed to modify the cacerts file or use a separate cacerts file.
The root certificate is there. I think I accidentally tested this on a server that was out of date.