SSL Certificate Settings created by an admin process for endpoint

Yeah I’ve investigated this before, from memory I don’t even think it gets logged - I found it by attaching to w3wp.exe with a debugger and setting a breakpoint in the application start. It’s not specific to Certify - you can preproduce it by manually changing an https binding in IIS manager.