The pki OpenConnect certificate-usage check compares against a variable leaked from the preceding HAProxy loop.
Location
src/conf_mode/pki.py:529-544
Problem
tmp in cert_list compares against the last HAProxy iteration's variable; if the loop never ran, NameError.