Footnote — What is in the certificate's SAN?

If you need to check exactly which hostnames and IPs the current certificate
covers (its Subject Alternative Names), run this from any machine that can
reach the box:

openssl s_client -connect 192.168.X.Y:8443 -servername bng < /dev/null 
  | openssl x509 -text -noout 
  | grep -A1 'Subject Alternative Name'

Replace 192.168.X.Y with the management IP of the box. The output will show
the DNS names and IP addresses the certificate is valid for. If the address you
are using is not listed, even a fully-trusted CA will produce a mismatch warning.