Certificate authentication is not working on Web application proxy/ADFS

Good morning,

I have been setting up an ADFS server and Web Application proxy. I have gotten it to the point that is authenticates our external applications using user name and password, yet I've noticed in developer tools that when users authenticate with their certificate, initially the prompt for them to add their certificate pin will show up but instead of redirecting their SAML request to adfs/ls it will redirect their SAML request to adfs/certauth and give a 503 service not available.

On the ADFS when I look at the endpoints I see the endpoint for adfs/ls but not adfs/certauth. I do see an endpoint for adfs/servertrust/certificates (not the exact name). If I open a browser externally, on the ADFS or the WAP I can reach the adfs/ls endpoint but the adfs/servertrust/certificates redirects to the same 503 error. If I go to the adfs/ls endpoint in a browser on the WAP, ADFS, or external URL it brings me to the logon page.

If I change the adfs/ls endpoint to adfs/cert auth it also brings me to the slash page.

My Certificate for the ADFS and WAP are the same and have the certauth added as a SAN. And the application has 49443, 443 allowed inbound, and the firewall is not interfering.

I've compared this new ADFS to an existing one which properly authenticates users with their token and it has all the same ADFS authentication methods selected. On the ADFS that is working the Services, Tokensigning, and decrytpting certs all had the same thumbprint. So I changed the ADFS not authenticating certs to use the same services cert's thumbprint for the token certs. This still did not result in the authentication working for certificates.

I have added a DNS entry for both the auth and certauth using the WAP's private IP. I have also published the external application to use Pass through auth using the external cert and external login url of the app with no success.

I do not understand why at authentication the external application's URL redirects from adfs/ls to adfs/certauth. I have a hunch this is the issue, but can anyone provide any other ideas for what to try next?