Answer
Check the environment's Client Signing configuration option during reconfiguration — it has three settings: 'Use same certificate as web server' (signs using the web server's own certificate), 'Use self-signed test certificate' (intended for testing only, not production use), and 'Import third-party certificate' (signs using a certificate you've imported). A client-signing failure like this is often traced to the environment having drifted onto (or never properly moved off) the self-signed test certificate option, or to an issue with whichever certificate the selected option actually points at — reconfiguring the instance with the correct, non-test Client Signing option for a production-style environment resolves it.