diff --git a/spec/puppet-server-lib/puppet/jvm/config_spec.rb b/spec/puppet-server-lib/puppet/jvm/config_spec.rb
index 9fd05e842..a03a2844d 100644
--- a/spec/puppet-server-lib/puppet/jvm/config_spec.rb
+++ b/spec/puppet-server-lib/puppet/jvm/config_spec.rb
@@ -42,11 +42,23 @@
       end
     end
 
+    it "falls back to the vendored PEM CA bundle when the keystore is absent" do
+      stub_const('Puppet::Server::Config::PUPPET_KEYSTORE_LOCATION',
+                 'spec/fixtures/does-not-exist')
+      stub_const('Puppet::Server::Config::PUPPET_CA_BUNDLE_LOCATION',
+                 'spec/fixtures/ca-cert.pem')
+
+      expect(Puppet).not_to receive(:warning)
+
+      ssl_context = Puppet::Server::Config.puppet_and_system_ssl_context
+      expect(ssl_context).to be_a_kind_of(Java::JavaxNetSsl::SSLContext)
+    end
+
     it "warns if :ssl_trust_store is set but not readable" do
       Puppet[:ssl_trust_store] = "spec/fixtures/foo.pem"
       allow(File).to receive(:exist?).and_return(false)
 
-      expect(Puppet).to receive(:warning).with(/Could not find OpenVox-vendored keystore/)
+      expect(Puppet).to receive(:warning).with(/Could not find an OpenVox-vendored trust store/)
       expect(Puppet).to receive(:warning).with(/The 'ssl_trust_store' setting does not refer to a file/)
 
       Puppet::Server::Config.puppet_and_system_ssl_context
diff --git a/src/ruby/puppetserver-lib/puppet/server/config.rb b/src/ruby/puppetserver-lib/puppet/server/config.rb
index a9c714178..2a1711f6b 100644
--- a/src/ruby/puppetserver-lib/puppet/server/config.rb
+++ b/src/ruby/puppetserver-lib/puppet/server/config.rb
@@ -19,6 +19,7 @@
 
 class Puppet::Server::Config
   PUPPET_KEYSTORE_LOCATION = '/opt/puppetlabs/puppet/ssl/puppet-cacerts'
+  PUPPET_CA_BUNDLE_LOCATION = '/opt/puppetlabs/puppet/ssl/cert.pem'
   CERT_REGEX = /.*-----BEGIN CERTIFICATE-----.*/
 
   def self.initialize_puppet_server(puppet_server_config)
@@ -82,8 +83,16 @@ def self.load_puppet_and_system_ssl_context
     truststore = stores['truststore']
     if File.exist?(PUPPET_KEYSTORE_LOCATION)
       associate_entries(truststore, PUPPET_KEYSTORE_LOCATION)
+    elsif File.exist?(PUPPET_CA_BUNDLE_LOCATION)
+      # puppet-runtime stopped shipping the Java keystore form of the
+      # vendored CA bundle (puppet-runtime@066fd48); load the PEM bundle
+      # it still ships instead.
+      SSLUtils.associateCertsFromReader(
+        truststore,
+        'openvox_vendored_ca_bundle',
+        FileReader.new(PUPPET_CA_BUNDLE_LOCATION))
     else
-      Puppet.warning("Could not find OpenVox-vendored keystore at '#{PUPPET_KEYSTORE_LOCATION}'")
+      Puppet.warning("Could not find an OpenVox-vendored trust store at '#{PUPPET_KEYSTORE_LOCATION}' or '#{PUPPET_CA_BUNDLE_LOCATION}'")
     end
 
     if additional_store_location = Puppet[:ssl_trust_store]