Cf_ca_cert empty for 4.x


I have configure cf auth on 4.2.3 as follows:

     api_url: <redacted>
     ca_cert: |
       -----BEGIN CERTIFICATE-----
       -----END CERTIFICATE-----
     client_id: <redacted>
     client_secret: <redacted>

This results in atc failing to start because of an empty /var/vcap/jobs/atc/config/cf_ca_cert

If I manually put the cert in /var/vcap/jobs/atc/config/cf_ca_cert and do a monit restart atc, atc comes up.

Is my syntax incorrect?