The cert_path and key_path values specified in the configuration are ignored by the code in websocket.go (see code below). Hardcoded values are used instead.
err = http.ListenAndServeTLS(cf.BindAddress, "cert.pem", "key.pem", newHTTPMux)
When uploading a cert with a different name, like fullchain.pem and privkey.pem, the code generates a self-signed cert.pem and key.pem and uses those instead of the uploaded cert.