I have a older 10.3.1 ArcGIS Server installation that I am maintaining. Recently, the primary publisher of the server told me that the server is reverting to HTTP Only for its protocol after the service is restarted in the Windows Services control panel.
I've verified that this is, in fact happening. After the service is restarted, a new config.json.rlock file is taken and than, after a few minutes (presumably after the server have completed startup), the rlock file is updates (new timestamp) and the config.json file is changed to set sslSecurity to false. The config.json file have the same last modified timestamp as its corresponding rlock file.
Obviously updating from 10.3.1 is the final plan, but I am wondering if anyone else has seen this behavior and is aware of a way to fix it in the short-term. The ArcGIS Server is a base installation and does not have any patches applied, as far as I know.