Using the 9.1SP3 base installer to update an EktronWindowService from 9.X to 9.1Sp3 causes the certificates to be invalid.
As a work around, in the Ektron.ASM.EktronServices40.exe.config, find these three bindings: wshttpSyncCommunicationScheduleService, wshttpSyncQueueService, and wshttpScheduleServiceBinding.
In the message section within those, change the negotiateServiceCredential from false to true.