Well, if you're in pass through mode (rather than termination) then you need to make sure that any/all hostnames that use the cert are a part of the certificate.
It would appear that you have the web/manager roles on the same server and then created unique VIPs for the web and manager services (correct thing to do), and then created LB pools for them both, with the same servers (also the right thing to do).
You have manager.ra.local resolving one VIP, and web.ra.local resolving the other.
Where you appear to have gone wrong is making use of a single certificate, manager.ra.local, with no subject alternate name of web.ra.local (or vice versa, hard to tell).
Grant