Had same issue.. this is even more fun when running multiple vCenters under the same SSO...
Then you get the intermediate cert presented instead of the vCenter certs. Causing duplicate cert entry in the database.
This even causes that only one vCenter will work and the others will fail to even mount App Stacks.
Thankfully this quick bypass solves it and will be patched in 2.13