Captive Portal / Blocked Page (Port 8090) Presents Wrong Certificate

Kia ora!

I'm running (SFOS 18.0.3 MR-3).  I was under the impression that the certificate selected in admin settings should be used for all XG services but I'm being presented with a different one on port 8090:

I've tried setting the certificate back to the default one then back to my self-signed one again. I've tried rebooting the FW.

Am I missing a setting somewhere?