Microsoft Exchange 2013 iApp - Can't login to OWA or ECP if more than one server is active in pool

IIRC, the OP had to change their internal OWA URL to their CAS name while keeping the external URL the OWA FQDN. Not sure why that worked, since we've tested extensively with a single namespace for OWA and it works fine. If you run a "Get-ExchangeCertificate | fl" in PowerShell, does the cert you have assigned to IIS show up as valid?