When You Hit This Wall
You're setting up hosted email on a Windows Server 2022 box using the built-in Email Setup Wizard (the one that comes with IIS or Exchange hybrid). You fill in all the fields — domain, mail server name, auth credentials — but it hangs at the last step with "The wizard could not complete" or error 0x80070005. The server was renamed a few weeks ago, and you didn't rebuild the SSL certificate after.
This happens most often on freshly promoted domain controllers or servers that got a name change for branding reasons. The wizard tries to bind to port 443 using a certificate that's tied to the old server name, and the handshake blows up.
Why It Breaks
The root cause is simple: the SSL certificate stored in IIS still references the old server's FQDN. When the wizard tries to create the SMTP or IMAP endpoint, it picks up the default binding — which points to the old name. The client side sees a certificate name mismatch and kills the connection. The error code 0x80070005 translates to "Access Denied", which makes you think it's a permissions issue. But what's actually happening is the TLS handshake fails silently, and the wizard interprets that as a security violation.
The wizard doesn't tell you "hey, your cert is wrong". It just says "can't complete". Classic.
How to Fix It
You need to remove the old certificate binding and replace it with a new self-signed cert that matches the current server name. Here's the exact order.
- Open IIS Manager — Start > run
inetmgr. Go to the server node, then double-click Server Certificates. - Create a new self-signed cert — In the right pane, click Create Self-Signed Certificate. Enter the server's current FQDN (e.g.,
mail.yourdomain.comif that's your mail hostname). Set the store to Web Hosting. - Check current bindings — Go to Sites > Default Web Site (or your mail site). Click Bindings in the right pane. Look for the HTTPS binding on port 443. If it shows the old cert name, note the IP and port.
- Remove the bad binding — Select the HTTPS binding and click Remove. Don't worry, you'll add a new one in a sec.
- Add the correct binding — Click Add. Set Type = https, IP = All Unassigned, Port = 443. Under SSL Certificate, pick the new cert you created. OK out.
- Restart IIS — Run
iisresetas admin. This forces the wizard to pick up the new binding. - Re-run the wizard — Open the Email Setup Wizard again. It should pass through the last step now. If it still fails, move to the checks below.
What to Check If It Still Fails
Sometimes the wizard caches the old binding. Kill that cache:
net stop w3svc & net stop WAS
cd C:\Windows\System32\inetsrv\config
ren applicationHost.config applicationHost.old
Then restart IIS (net start w3svc). This regenerates the config file from defaults. You'll lose any custom IIS settings, so only do this if you're comfortable re-configuring.
Also check if the wizard is hitting the right port. Run netstat -an | findstr :443 and make sure it's listening. If it's not, something else (like Skype or another app) grabbed port 443. Use netstat -aon to find the PID and kill it.
Finally, if you're using Exchange hybrid, the wizard might be looking at the old cert in the Exchange Management Shell. Run Get-ExchangeCertificate | fl and remove any with the old subject name using Remove-ExchangeCertificate.
That's it. The fix is always the cert. Don't waste time on permission hunting.