That's quite a strong claim in the face of evidence to the contrary! 🙂

Jul 08 10:55:14 <http://puppetserver.domain.com|puppetserver.domain.com> puppetserver[2162559]: (RuntimeError) Got 1 failure(s) while initializing: File[/etc/pki/tls/certs/ca-bundle.crt]: change from '0444' to '0644' failed: failed to set mode 0444 on /etc/pki/tls/certs/ca-bundle.crt: Operation not permitted - No message available

puppetserver wants that file to have specific permissions and tries to make it so! Though I agree nothing in puppet/puppetserver out of the box would be trying to change the permissions away from the desired ones, and have never seen this error myself.