Could you try to use this from a browser:
https://[productionserver]/idp/.well-known//uris
It should return a json string, but more importantly you can see if the client accepts the certificate. It could be the server has a certificate, but either the client doesn’t trust it or it is not applied correctly to the IIS.
Regarding the failing login, are you able to login to the server through smart client (or management client) with the same credentials? Are you using secureonly parameter? Secure only will only work if the client can validate the certificate.