0

I have 4 identical Exchange 2016 servers. A little over a month ago, I renewed my wildcard cert on all 4 servers and assigned it to services IIS and SMTP -- on all 4 servers.

Today, I noticed that one of the 4 is throwing Event ID: 15021

An error occurred while using SSL configuration for endpoint [::]:443.
The error status code is contained within the returned data.

None of the other servers have this issue, but I don't have a solid sense of when it may have started.

I am running Windows Server 2016 Standard.

Patrick Mevzek
  • 9,921
  • 7
  • 32
  • 43
pmo051
  • 19
  • 1
  • 1
  • 4
  • This question may have been answered here: https://serverfault.com/questions/675518/an-error-occurred-while-using-ssl-configuration-for-endpoint-0-0-0-0443 – simonpa71 Dec 10 '20 at 13:51

2 Answers2

1

This (usually) means, that the endpoint 0.0.0.0:443 on this server uses a certificate that does not (or no longer) exist.

The easiest way to verify this is to go to the IIS Manager and look whether port 443 is still bound to the 'old' SSL certificate.

Or you can do this ("As Administrator") with

netsh http show sslcert

In the output, search for the certificate of 0.0.0.0:443 and 127.0.0.1:443. They should be identical (and most likely aren't).

This can be corrected with netsh, too:

netsh http add sslcert ipport = 0.0.0.0:443 certhash = <HASH> appid = {<YOURAPPID>}

Use the values from your working 127.0.0.1:443 binding.

bjoster
  • 4,805
  • 5
  • 25
  • 33
  • I confirmed mismatch. I followed your instructions and I still have a mismatch... even if I "netsh http delete sslcert ipport=0.0.0.0:443" immediately after "iisreset" then "netsh http show sslcert" still shows the cert for [::]:443 present. – pmo051 Nov 17 '20 at 13:53
1

Thank you @bjoster. You stimulated some brain cell that caused me to analyze these "identical" servers. Somehow [::]:443 only existed on the server throwing errors. netsh http delete sslcert ipport=[::]:443 Thank you for your time and inspiration!

pmo051
  • 19
  • 1
  • 1
  • 4