SSL certificate issue

[Altostratus]

I'm running a TS-431K and have issued a Let's Encrypt SSL certificate through the admin interface, after following several forum posts, opening 443 & 80 etc. The page "SSL & Private Key" in Security now displays "Issued by Let's Encrypt" with all my three subdomains names listed under "Alternative name". However, when I try to access one of the domains (which is configured in Reverse Proxy to redirect to another machine on the LAN), I get MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT and the certificate displayed in the browser says it was issued by Qnap. How is that possible? It doesn't seem to involve the cache, because I've tried the same access with Safari and got the same result.

Slightly less worrisome: I suppose it's now normal, when I access the admin interface locally after changing the certificate, that I need to set an exception for the "bad domain name" certificate error, since I'm accessing it through 192.1.168.x rather than through the domain name. Is that correct?

Thanks for your help.