Your server.conf seems to have only apps.splunk.com as the SSL common name. If you want to allow client with CN=cdn.apps.splunk.com then you will have to update applicationsManagement stanza:
https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Serverconf
... View more