I ran into this one today with two servers in a DAG. This is caused by the certificate you're using not having the private key. Here's how I fixed it:
Go to the 1st server -> Start -> Run -> MMC -> File -> Add/Remove Snap Ins -> Certificates -> Computer Certificates -> Local Computer
Browse to the personal certificate store, right click on the correct certificate, select All Tasks, and then Export. Make sure here you choose "Export Private Key" and assign a password. Click Next and then name the file and where you want to save it. The file will have a .pfx extension.
From there on the 1st server inside ECP you can go to Servers -> Certificates -> Choose the server you want and then import the certificate.
Once this process is done just assign the services to the certificate (SMTP, POP, etc) and then restart the server if possible. If not some say you can do an IISRESET from the command prompt and then you'll be good.