The logs say -2... And the session variable session.windows_check_machinecert.last.result==-2.
TBH it would be easier to work out what's happeneing if the log messages were in order (It seems to log strangely. e.g. SECURID module logs before you get a message sayign it's following the 'fallback' rule from Login page to 'RSA SecurID'... But I certainly get a message saying it's following the rule 'fallback' from item 'machine cert check' to terminal 'nocert' (nocert is a custom name for the fallback from the machine cert check).
H