manage the certificate used for default connexion too, since that's the one that xymon check for expiry ( and that's also what openssl does ). Probably a issue with SNI, didn't look more in details for tonight
puppet/modules/apache/manifests/init.pp
puppet/modules/apache/templates/01_default_ssl_vhost.conf