In a lab environment, I wasn’t able to access the password registration portal from any server other than the FIM portal server. Turns out, I’d missed setting the SPN for the HTTP/Password Registration and Reset portals.

http://social.technet.microsoft.com/wiki/contents/articles/4118.aspx