The only solution I could find was from old forum posts referring to a Set-RDPublishedName.ps1 custom script that has disappeared from the Technet gallery. Luckily found below:
https://github.com/dwj7738/My-Powershell-Repository/blob/master/Scripts/Set-RDPublishedName.ps1
This can't be real life though. How can you achieve this without custom scripts and stuff? SSO can't work if the "Published Name" or these addresses don't match the certificate...? But there is no way to change them to match the certificate?? Makes no sense. What am I missing here nothing is documented theres no other admins jumping up and down about this missing??