This is a shot in the dark, but does ca-bundle.crt contain multiple certs? Have you tried splitting them into individual files and providing each file in the certificate_authorities list in Filebeat?
Also, does Filebeat work if you disable certificate verification using verification_mode: none?