What? A CDN accessed over TLS needs some kind of cert, sure. I don't see how this connects to whether the CDN pulls off the wrong server.

Obviously if the CDN has cert X then any authentication it may have should use cert Y.