I've seen this caused by an expired Cert bound to RDP.
run nmap (or zenmap) against the server to see if it returns a thumbprint of the cert bound to 3389. If it does not return a thumbprint (and you know you use them) then that can be a problem.
To solve, access the server via local console.
Now check the SSL Cert bound to 3389 RDP by running the following from an elevated command prompt
wmic /namespace:\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Get SSLCertificateSHA1Hash
Does the thumbprint match a valid cert you are using in the Personal or RDP store? If not, then update it with a new certificate's thumbprint using :
wmic /namespace:\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<thumbprint without spaces>"
Restart Remote Desktop Services from services.msc
Should work.
You can get the certificate thumbprint from certlm.msc in the personal store. Please note, I say thumbprint, not serial.
Hope this helps.