Thanks for the quick response and the effort in recreating the issue!
It all played out exactly as you laid it out, even the cert showing up as a .new.pem at first.
Out of curiosity, what in your testing did result in causing this issue? Is it possible that my upgrade from 8.2 to 8.3 may have caused the underlying issue?