I just went through this issue, and I had to tell the default web site on each machine in my federated scenario NOT to Accept certs, instead to Ignore. The /adfs/fs and /adfs/ls directories are properly configured to require SSL and Accept/Ignore accordingly so the root web site need not be configured for this.