My 3rd attempt didn't go too well :-( I forgot to take the snapshot before the upgrade this time and completely got myself screwed up! A successful test of our backup solution brought me back to a recent version of the VM and I'm now back where I started.
My plan is to bring in a 3rd connection server to support internal connections by using a certificate with the same alias SAN and try to round robin my FDQN which we have alias to view.blah.blah. Our zero clients have the certificate installed to force them to use the view.blah.blah certificate, which means they are useless once the connection server is out of action. If the round robin works then at least I can battle with the upgrade to the legacy 5.2 internal connection server. Fingers crossed it all goes well.