Adding certificates to Azure VM Scale Set

Basically I'm trying to follow this guide..

http://ronaldwildenberg.com/custom-domain-name-and-certificate-for-your-azure-service-fabric-cluster/

It says here (regarding Resource Explorer):

If you save (PUT) the updated VM Scale Set resource description, the certificate will be installed to all VMs in the scale set.

I've done this (adding my new cert to the key vault, then referencing it in the template), upon saving, the portal says provisioning, and completes, but rdp'ing into the VM's the certificate isn't there! And thus my service fails (error given in event viewer is HttpCertCfg returned errorcode 0x80070520)

What's going wrong? :(

Here's a walkthrough on MSDN. It deploys a secondary cert, then swaps.