Answer
When the installer's own reconfiguration flow gets stuck trying to stop the HTTP servers as part of a broader reconfigure, running the relevant start/stop scripts directly from the Middleware Server's own \bin folder (rather than going through the full installer UI reconfiguration flow) has successfully worked around this in a confirmed case — this let the HTTP components actually stop and restart cleanly, after which the full reconfiguration (including applying an updated server certificate) completed successfully. If the installer's own automated HTTP-server-stop step is failing, bypassing it with the bin folder's own scripts is worth trying as an escalation step.