Puppetserver uses puppet libraries to ensure it's runtime environment is setup sanely which includes things like making sure it's log directories exist and have the correct ownership. Because it runs as

puppet

and not

root

, it's not able to correct all the problems it finds, so startup will fail if the host isn't in a suitable state. I wasn't aware puppetserver cared about the ownership of the

/etc/pki/tls/certs/ca-bundle.crt

file, but obviously it does. Setting the ownership of the file back to 0644 manually would have allowed puppetserver to startup, without adding it to the wheel group. If you have something managing the permissions on this file to 0444 (e.g. some puppet code which puppet agent is applying on your puppetserver host), it will fight with puppetserver on startup, best to reconcile that into the state that puppetserver wants it in, e.g. 0644 rather than 0444.