I don't know what version you are running but this MAY be your issue. I beat my head against the wall for like 9 hours thinking I did something wrong with the cert install and application. Used the ADSM and CLI. Nothing. I re-issued the cert 3 times even. Every time I applied the cert to the interface and would connect to the VPN or the Anyconnect home page, I would get the "Untrusted" warnings even though the cert was from a commercial SSL provider (not self signed). When I would look at the cert, it was always a self signed one. I even when into the command line, removed all the certs and keys using the zeroize commands. Showing crypto ca and keys resulted in nothing. Re-issued cert, installed and applied to interface and still the self signed. Thinking maybe the browser cached the cert, I tried different browsers and then went to web based SSL testers. I finally ran one from Symantec that found the RSA certificate I was getting from my commercial provider BUT it also found a ECC certificate! Where did that come from and why was it using that when I clearly had commands in SSL and VPN to use the commercial RSA one.
Finally I opened a case with Cisco. Turns out they found some reference to "Elliptic Curve Cryptography" and it says that in 9.4.x software, when a ECC capable SSL VPN client connects to the ASA, the ECC certificate has precedence. So it basically appears that the internal self signed certificate is an ECC certificate (say the one used to connect ASDM). And even though you have applied the RSA version to the outside, it won't work. It will use the self signed instead.
TO ME THAT SAY BUG! ... I guess they don't agree.
In any case, the solution was to create a "custom" cipher precedence for SSL. This was done with the following command:
ssl cipher tlsv1.2 custom
"AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DES-CBC3-SHA:DES-CBC-SHA:RC4-SHA:RC4-MD5"
This resolved my issue. Might help if you have 9.4.x
