Yah I found out later that after reconnecting the host following replacing the faulty certificate with the correct CA signed one, this broke ability to apply customization as well.
I set everything up from scratch several times to get these steps right and the certs all correct so it is frustrating that it still doesn't work.
Does anyone have CA-signed certs working with VCSA? If not, I don't understand why VMWare doesn't release a KB addressing this.