No reponse to this question so after a week of restoring backups of the previous ITMS install, we figured it out.
You need to remove the trusted CA SSL certificate from IIS and the SMP Communication profile before running the SIM update
After the update has completed and you have exported your data store and imported it again (using Migration Wizard)
and the server is up and running again you add the SSL certificate back into SSMP communications profile and IIS
and run update configuration task on all clients