In the screenshot below you see the error. Not very helpful to begin with. The log the error is referring to can be found in %ProgramData%. It is ARRConfig.log. If you open the log it will show the actual problem. What this means is that it cannot read the Private Key from the pfx file even it is in there. This is some quirk in the way Microsoft handles pfx files and it does not happen in every pfx certificate. The actual Reverse Proxy site has been created though the error said ‘create site failed’. Now what happened? It actually created the site but failed to set bindings to port 443 with the certificate we used. Right click the site and choose Edit Bindings. Choose to edit the https binding. There is no certificate listed. Choose the certificate you used to run ARRConfig and click OK. Ah, there is the error ARRConfig also had. Click OK and cancel out. Highlight the server and click certificates. If you choose the mail.server-essentials.net certificate and right click there should be an Export option listed but there is not, this is a problem because the Private Key must be available for ARRConfig to work properly Choose to Remove the mail.server-essentials.net certificate. Click Yes. It is gone In the Actions pane choose Import Browse to the mail.server-essentials.net certificate. Give a password and make sure ‘Allow this certificate to be exported’ and click OK. If you now right click the mail.server-essentials.net certificate it has an Export option. Choose to Export. Export the certificate to the same folder where the other certificates are and name it mail.server-essentials.net.fix.pfx and enter a password. You will need to the password again when you run AARConfig One the certificate has been exported delete the one in IIS. Click Yes. When you now run ARRConfig with the ‘fixed’ certificate it will work…done!