On one of our Exchange servers, the System log filled up with this error every few seconds:

Log Name: System
Source: Microsoft-Windows-HttpEvent
Event ID: 15021
Level: Error
Computer: EX01.domain.com
Description:
An error occurred while using SSL configuration for endpoint 0.0.0.0:444.
The error status code is contained within the returned data.

SSL configuration for endpoint

What it means: Windows' HTTP service (HTTP.sys) has an HTTPS listener on that IP and port with no valid certificate bound to it. Either no certificate was ever bound, or the bound certificate was deleted, replaced or has expired. Port 444 is the Exchange Back End site, so on Exchange this usually appears after a certificate renewal or cleanup. Users often notice it first as OWA or ECP failing after login.

The same error appears for other ports, and the fix is the same idea:

Endpoint What uses it
0.0.0.0:444 Exchange Back End website (IIS)
0.0.0.0:443 Default Web Site or any IIS / HTTP.sys HTTPS site
0.0.0.0:5986 WinRM over HTTPS

Applies to: Exchange Server 2013, 2016, 2019 and Subscription Edition; IIS on Windows Server 2012 R2 – 2025.

Step 1: Confirm the binding is broken

netsh http show sslcert ipport=0.0.0.0:444

If it returns nothing, or a Certificate Hash that's no longer in the computer's certificate store, that's the problem.

Step 2 (Exchange): Find the right certificate

The Exchange Back End site must use the self-signed certificate Exchange created during setup (friendly name Microsoft Exchange, subject CN=<servername>). It must not use the Microsoft Exchange Server Auth Certificate, and normally not your public certificate either.

Get-ExchangeCertificate | Format-List FriendlyName, Subject, Thumbprint, NotAfter, Services

If that self-signed certificate has expired or was deleted, create a new one:

New-ExchangeCertificate -FriendlyName "Microsoft Exchange" -SubjectName "cn=$env:COMPUTERNAME" -DomainName $env:COMPUTERNAME, ([System.Net.Dns]::GetHostByName($env:COMPUTERNAME).HostName) -PrivateKeyExportable $true

Step 3: Bind the certificate in IIS

Event Id 15021

  1. Open IIS Manager → Server → Sites → Exchange Back End.
  2. Click Bindings… in the Actions pane.
  3. Select the https binding on port 444 → Edit.
  4. The SSL certificate field will be empty or wrong. Choose the Microsoft Exchange self-signed certificate → OK.
  5. Run iisreset /noforce.

Command-line alternative

If IIS Manager won't save the binding, delete it and add it again with netsh (use your certificate's thumbprint):

netsh http delete sslcert ipport=0.0.0.0:444
netsh http add sslcert ipport=0.0.0.0:444 certhash=THUMBPRINT appid={4dc3e181-e14b-4a21-b022-59fc669b0914} certstorename=MY

{4dc3e181-e14b-4a21-b022-59fc669b0914} is the standard application ID IIS uses for its SSL bindings.

Step 4: Verify

The 15021 errors stop, and the System log shows an informational HttpEvent entry:

SSL Certificate Settings created by an admin process for endpoint: 0.0.0.0:444

If you see "SSL Certificate Settings deleted for endpoint" in the log, something removed the binding. That's usually a certificate cleanup script or an Exchange certificate removal that was still bound to the site.

Same error on 0.0.0.0:443

Repeat Step 3 for Default Web Site, binding https / 443. On Exchange, this site uses your public or internal CA certificate (the one assigned the IIS service with Enable-ExchangeCertificate -Services IIS), not the self-signed one.

Same error on 0.0.0.0:5986 (WinRM HTTPS)

WinRM's HTTPS listener is pointing at a certificate that has been renewed or removed. Check it and recreate it with the new certificate:

winrm enumerate winrm/config/listener
Get-ChildItem WSMan:\localhost\Listener | Where-Object Keys -like "*HTTPS*" | Remove-Item -Recurse
New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * -CertificateThumbPrint THUMBPRINT -Force

Preventing it

  • After renewing or replacing any certificate on Exchange, check both sites: Default Web Site on 443 and Exchange Back End on 444.
  • Track the self-signed Exchange certificate's expiry date (NotAfter) along with your public certificates. It lasts five years, so it's easy to forget about.
  • Never delete a certificate from the store without checking netsh http show sslcert for bindings that use its thumbprint.

FAQ

Which certificate should the Exchange Back End use?

The self-signed Microsoft Exchange certificate created at install, with subject CN=<servername>. Not the Auth certificate.

Does this affect mail flow?

Mail transport (SMTP) keeps working, but client access through the Back End site breaks, including OWA, ECP and EWS for mailboxes on that server, so users notice quickly.

Do I need to restart the server?

No. An iisreset /noforce after fixing the binding is enough.

Related: Restrict Exchange ActiveSync devices · Disable SSL 2.0/3.0 and TLS 1.0/1.1 · Convert a CRT certificate to PFX