if additional cert bundle does not include all public certs custom CA's will work but public CAs will not when file is named ca-certificates.crt.  
It appears that kaniko is using / creating that file during execution to include built in public certs.