From my testing (all the way down to registration and package install) I only found that tomcat needed a stripped cert to function. I'll add an option to the key_bundle to allow stripping when needed in the future if we see this issue similar to what I added to the pubkey.