So the basic checks:
1. check the time stamps on all vCD Cells ... they need to be in sync, because the VMRC connection is only valid for a short window. Time skew only makes this worse.
2. as per above, ensure to configure the Console Proxy Public address. This NEEDS to correspond to the DNS Entry placed into the SSL Certificate of every single vCD cell, and the DNS entry must resolve to the Cell/Load Balancer.
3. ensure that you use the same certificate in every single cell for the VMRC. Not just the same data, the exact same certificate. We do a thumbprint check ... if you get a thumbprint from one cell, and it differs on the cell you hit for VMRC ... it'll fail.
4. self signed certificates are usually fine, as long as you trust the VMRC URL manually (in case you have enforcement on). They do need to follow the previous notes as well.