Losing SSL Certificate in IIS every night

Question

After configuring IIS so that our SharePoint (Topology) Web Service is bound to a SSL certificate, we have successfully tested it in a load balancing scenario. However, we are finding that the binding's are being lost each day or night - it seems to happen once a day. When I go back into IIS, the SSL Certificate is selected as 'Not selected'. Sometimes setting the value back in IIS does not stick and a powershell command is required to add it (again) successfully, such as below.

Import-Module WebAdministration
(Get-WebBinding -Name "SharePoint Web Services" -Protocol https).RemoveSslCertificate()
(Get-WebBinding -Name "SharePoint Web Services" -Protocol https).AddSslCertificate($certHash, "MY")

We are now considering running this PowerShell script in an hourly timer job if we can't resolve this issue. Any ideas?

thumbprint from 1st Service App box

#$certHash = "E4716ABDDD338D30BC17DF09B7B94F542B56F509"

thumbprint from 2nd Service App box

#$certHash = "631471069B1D22B8A5607E497EC7B6B3DDCCFFC3" 

Answer 1

Have you tried removing / re-installing IIS?

You may want to disable or block remote administration tasks (admnin shares, remote-registry, etc) and see if the problem persists. If it clears up, you will want to investigate any items being pushed out to your server including scripts, GPO's, and remote commands.

Do you have any SCHannel errors in your system log? I have never seen this type of behavior before, but SChannel errors have caused many issues with SSL/TLS, which almost always required some sort of service fix or re-installation.

Answer 2

This problem may be due to the permission issue. Please check the Certificate permission as well as the SharePoint web application application pool permission.