Hi John,
Primary PAN selects one of the PSN's to test the HotSpot Portal page but it uses the PSN IP instead of the FQDN or CN of the signed certificate. You can copy the link from the additional testing browser displayed in notepad, replaced the ip by the CN of your certificate and it should work. If it does not work, then your PSN's do not have the cert installed for portal or your DNS does not have an entry for that URL pointing to all the PSN's.
On my case the link for testing the HotSpot Portal says the following and I got an error because that IP is not part of the certificate presented by the PSN Node when running Portals.
https://10.10.10.10:8443/portal/PortalSetup.action?portal=99e23270-7fe3-11e5-aa03-3440b5d4e810
So I replaced the ip by the CN/FQDN of the certificate used for Portals in order to do a proper testing and it worked.
https://isePSNnode.domain:8443/portal/PortalSetup.action?portal=99e23270-7fe3-11e5-aa03-3440b5d4e810