WSUS Server – How to Stop Reverting Back to Default IIS WSUS Administration SSL Settings

iissslwsus

After, configuring my WSUS to use SSL it either says connection error or reverts back to http. I have a week working on this and I implemented anything that might be the probable solution.

This is the first error I get:

"WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. —> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
at System.Web.Services.Protocols.WebClientProtocol.GetWebResponse(WebRequest request)
at System.Web.Services.Protocols.HttpWebClientProtocol.GetWebResponse(WebRequest request)
at Microsoft.UpdateServices.ServerSync.ServerSyncCompressionProxy.GetWebResponse(WebRequest webRequest)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at Microsoft.UpdateServices.ServerSyncWebServices.ServerSync.ServerSyncProxy.GetAuthConfig()
at Microsoft.UpdateServices.ServerSync.ServerSyncLib.InternetGetServerAuthConfig(ServerSyncProxy proxy, WebServiceCommunicationHelper webServiceHelper)
at Microsoft.UpdateServices.ServerSync.ServerSyncLib.A"

Okay fine, so I would proceed to do every appropriate fix there is which includes;

  1. Creating a certificate.
  2. Changing the SSL settings in the IIS manager wizard under WSUS administration.
  3. Changing values in the WSUS pool.
  4. configuressl domain.server.root.
  5. Restarting the wsusservice.
  6. open command prompt run as administrator and execute iisreset command.
  7. open services.msc and restart WSUS Service.

After is restart and open the wsus wizard I get the http "WebException: The underlying…" error again
and when I run wsusutil.exe configuressl again instead of it giving me an https with port number 8531 I get http with port 8530. Please help.

Best Answer

If you use a self-signed certificate, nobody is going to trust it by default.

This includes the WSUS server itself, which will refuse to use it; this seems to be the source of your error, which specifically mentions an untrusted certificate.

If you want to use a self-signed certificate you'll need to take additional steps to make it trusted, by importing it into the (machine) trusted certificate store; this need to be done on both the WSUS server and all WSUS clients.

You really should use a proper certificate for this; if you don't have an internal certification authority, it's probably time to set it up.

Related Topic