When trying to make everything encrypted, every now and then, you will run into "legacy" software that just simply doesn't want to work. Especially when you upgrade to something which all of a sudden supports encryption.
The same is the case with Policy Manager 12.1 and Client Security 12.1. In F-Secure's latest release, they have "improved" their SSL/TLS support. However if you have HSTS enabled, hosts cannot connect to the Policy Manager server anymore! They simply won't register themselves... But they will pick up files!
The easiest way to deal with this, is to create a separate domain for your Policy Manager to work on, if you want to use HSTS for your main domain that is.