When $JAVA_HOME/jre/lib/security/cacerts is a symlink to other file, we see the following message when starting dockerized hawkular-services with HAWKULAR_USE_SSL=true

keytool error: java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0/jre/lib/security/cacerts (Permission denied)

This is because chown won't resolve any symlink to change the ownership of the file unless you pass the -RH flag to resolve the path of the passed arguments.