Fix Exchange Hybrid Configuration Fails After IIS Reset
Question details
The Exchange Hybrid Configuration fails because the certificate configuration in the Exchange Backend IIS becomes empty after an IIS reset or server reboot.
- Product
- Microsoft Exchange Server
- Device & OS
- not provided
- Scenario
- Recovering Exchange Hybrid Configuration and EWS functionality after a server reboot caused IIS bindings to drop the SSL certificate.
- Observed behavior
- The certificate binding for the Exchange Backend site in IIS is completely blank, preventing Exchange Web Services (EWS) and the Hybrid Configuration Wizard from functioning.
Ensure you have administrative privileges to the Exchange Server, access to the Internet Information Services (IIS) Manager, and that your third-party SSL certificate is properly installed with its private key.
Verify and Reconfigure IIS Certificate Bindings
Manually re-bind the correct SSL certificate to the Exchange Backend and Default Web Site in IIS to restore Exchange Web Services.
When an IIS reset or server reboot causes certificate bindings to vanish, it typically indicates that the SSL certificate was not securely bound or the metabase failed to read the certificate store. Re-assigning it manually within IIS Manager resolves the connection drop.
Log into your Exchange Server as an Administrator. Press the Windows key, type 'IIS Manager', and open Internet Information Services (IIS) Manager.
In the left Connections pane, expand your server node, expand 'Sites', and click on 'Exchange Back End'. In the right-hand Actions pane, click 'Bindings...'.
Select the 'https' binding on port 444 and click 'Edit'. In the SSL certificate drop-down menu, select your valid Exchange certificate. Ensure this certificate has the correct private key and click 'OK'.
Close the Bindings window. Open Command Prompt as Administrator and type 'iisreset' to apply the restored binding configuration across your Exchange services.
Rerun the Hybrid Configuration Wizard (HCW)
Use the HCW to ensure your on-premises Exchange and Microsoft 365 environment are perfectly synced using the restored certificate.
Streamline Your Daily Office Tasks with WPS Office
While resolving complex Exchange Server issues requires specialized Microsoft server management, your day-to-day document handling shouldn't be complicated or expensive. WPS Office is a lightweight, completely free alternative to Microsoft Office that easily handles your reports, emails, and presentations.
Frequently Asked Questions
Why does the IIS certificate binding for Exchange drop after a reboot?
This generally happens if the installed SSL certificate lacks a corresponding private key in the Local Machine Certificate Store, or if third-party software interferes with the Windows Cryptographic Services during the startup sequence.
How do I verify if my Exchange certificate includes a private key?
Open the Microsoft Management Console (MMC) and add the Certificates snap-in for the 'Computer account'. Double-click your Exchange certificate in the Personal store; the General tab should explicitly state 'You have a private key that corresponds to this certificate'.
What Subject Alternative Name (SAN) entries do I need for Exchange Web Services?
Your certificate's SAN list must include your primary Outlook Web App/EWS namespace (e.g., mail.yourdomain.com) and the autodiscover namespace (autodiscover.yourdomain.com) to ensure client connectivity and hybrid features work correctly.
Can I use a self-signed certificate to run the Hybrid Configuration Wizard?
No, a Microsoft Exchange Hybrid deployment strictly requires a valid third-party SSL certificate trusted by a major public Certificate Authority (CA) to secure mail transport between on-premises servers and Microsoft 365.
