In step 4 of Solution 2 https://support.oneidentity.com/kb/258576/error-key-not-valid-for-use-in-specified-state-when-trying-to-log-in-to-the-application-server, should it read something like
IIS application pools are represented as a hidden local Windows SID. You can apply this SID as access control entry (ACL) on a Windows object (folder, service, or in this case the private key). To do this click Add, change “from this location” to the computername, and select OK.
Then without quotes, in the “Enter the object names to select” enter IIS AppPool\”the name of the ARS Web App Pool”. Ex: IIS AppPool\ARwebAdmin"