Parameter expansion with filters (certificates)

Hello,

Context:
brand new grr server installed from deb (ubuntu 16.04, grr 3.2.4-6), working perfectly well as is.

As we have our own pki, we would like to manage the keys/certificates ourselves. The best way to easily configure that (especially with a puppet server) would be to keep the certificates outsides the configuration using parameter expansion and filtering.

Exactly as mentioned here:
https://grr-doc.readthedocs.io/en/latest/maintaining-and-tuning/configuration/filtering.html
and
https://grr-doc.readthedocs.io/en/latest/maintaining-and-tuning/key-management/which-keys-and-how.html#code-signing-and-ca-keys

So, for example, we have that in our configuration:
CA.certificate: "%(/etc/grr/ssl/CA.certificate|file)"

And the properly formatted pem in "/etc/grr/ssl/CA.certificate"

However, doing that lead to not being able to repackage client, as it always fails with the following error:

ERROR:2019-05-08 15:34:30,004 1698 MainProcess 139806272059136 MainThread build:403] Build Config Error: CA certificate missing from config.
ERROR:2019-05-08 15:34:30,014 1698 MainProcess 139806272059136 MainThread repacking:192] Repacking template /usr/share/grr-server/grr-response-templates/templates/grr_3.2.4.6_i386.deb.zip failed:

Is there by any chance something we missed in hte configuration or is this by design?

Regards