Spatial-service SSL certificate not added to java keystore

[reupost]

After running the spatial-standalone playbook against an Ubuntu 16.04 instance, using our SSL certificates, I found that the site was correctly running on https, but adding new layers was failing to add the actual shapefile to geoserver.
The logs recorded errors like:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I needed to manually add our certificate to the java keystore on the server to resolve this.