IBCM internet and intranet management on the same server

Question

Could anyone help me see what I am missing? We are trying to test setting up IBCM using the same management point as the intranet clients. We have already successfully implemented PKI for intranet clients because we were bringing in a MacBook Air. We have
an external URL coming through reverse proxy and forwarded to our internal server. I can navigate to
https://sccmext.domain.com/sms_mp/.sms_aut?MPlist and get 403 access denied I also get that when I am on prem and navigate to the local server
The CcmMessging.log has errors regarding post to
https://sccmext.domain.com/ccm_system/request failed with 0x87d00231
I think this has something to do with certificates... I have a SCCM Web certificate for the internal server hostname and another certificate for the external name coming through the reverse proxy.
 I have the internet FQDN on the site system properties, MP and DP are set to allow internet and intranet based clients...

Answer 1

Here are some entries before and after that entry above:
10.7.29.195 GET / - 443 - 10.7.29.81 - 200 0 0 778 0
10.7.29.195 GET / - 443 - 10.7.29.82 - 200 0 0 778 0
10.7.29.195 GET / - 80 - 10.7.29.82 - 200 0 0 701 0
10.7.29.195 GET / - 80 - 10.7.29.81 - 200 0 0 701 0
10.7.29.195 GET / - 443 - 10.7.29.81 - 200 0 0 778 0
10.7.29.195 GET / - 443 - 10.7.29.82 - 200 0 0 778 0
10.7.29.195 CCM_POST /ccm_system/request - 443 - 10.7.29.9 ccmhttp 403 7 5 1466 15
10.7.29.195 GET / - 80 - 10.7.29.82 - 200 0 0 701 0
10.7.29.195 GET / - 80 - 10.7.29.81 - 200 0 0 701 0
10.7.29.195 GET / - 443 - 10.7.29.81 - 200 0 0 778 0
10.7.29.195 GET / - 443 - 10.7.29.82 - 200 0 0 778 0
These are from the IIS log file .195 is the SCCM site server, 81 and 82 are the reverse proxy servers. Sorry if I am not answering questions accurately, this is getting into parts of SCCM I am not familiar with at all.