A couple things I'd verify off hand:
-- Are you able to browse the native endpoint URL, using both HTTP and HTTPS, which is what the Workflow approval links (Approve, Reject, Delegate) would be using via the email notifications?
The URLs would be something like serverName:48620/.../GPService and CertificateHostName:48622/.../GPService, for example.
--As well, are you still able to get into the Dynamics Security Console and Web Services Exception Console, without any errors. In the Security Console, make sure you can click the 'Policy' node and see a list of policies show.
--Are you using an external third-party certificate for the Web Services HTTPS configuration, such as one from Verisign or GoDaddy? I just say this, as a self-signed or CA certificate won't, by default, work externally or off-domain as you put it.
After you have setup Web Services to use SSL, you should also set this in the Workflow Setup window, changing the Web Services server name to be the host name of the SSL certificate being used, change the port number to the SSL port number and mark the option to use SSL, so the approval links in the workflow emails will be using https and not http, which both internal and external users should be able to use.
Please let us know what you find with the information mentioned.
Thanks