TMG 2010 SP2 Exchange 2010 SP2 OWA Password Change not working

I'm using a TMG OWA publishing rule to publish OWA. My TMG server is a domain member. My Exchange server is configured for windows and basic authentication. I have an issue where if I set the user AD property "user must change password" at next logon, then they can't logon. If I take the tick box off, users can login fine - I'm testing password expiry.

I've checked the "allow user to changed password" box on the forms tab of the listener.

I've followed the blog below. Currently testing with a domain admin account and the required ports are open for LDAP. I've tried checking and unchecking the use LDAP and GC.

http://blogs.technet.com/b/isablog/archive/2012/05/07/tmg-2010-fba-troubleshooting-the-change-password-feature.aspx

The only thing I'm not sure about is that the link mentions that the LDAP certificate must be in the trusted root CA of the TMG and DC. Where do I define which certificate LDAPs uses?

I've also tried creating the key  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA.