Documentation forPatch Manager

Troubleshoot certificate errors during third-party updates

When you download or install third-party updates to clients of software distribution points, the targeted managed system may display certificate errors. These errors may include:

  • Certificate chain process terminated
  • Invalid signature
  • Failed to download

These errors may be caused by:

  • WSUS self-signed certificate not installed in the Trusted Root CA and Trusted Publishers
  • Allowed signed updates from an intranet Microsoft update services location setting is not enabled in the computer policy

To resolve these errors, verify that the WSUS certificate is installed on the client computers, WSUS server, SCCM server, and any other Windows-based system that generates errors when you download and install your software updates.

Check the Windows Update Policy

Verify that the WSUS self-signed certificate is located in the Trusted Root Certification Authorities. This certificate authorizes the installation of the signed content. Also, ensure that the policy on the computer has "Allow signed updates from an intranet Microsoft update services location" enabled.

  1. Locate and open the Resultant Set of Policy (RSOP) on the target computer. This policy reflects the current policy for the local and GPO applied to the system.

    Open a Search box and type:

    RSOP.msc

    Generating the policy may require several minutes to complete.
  2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update.

  3. Verify that the following policy setting is enabled:

    Allow signed updates from an intranet Microsoft update services location

    If the setting is not configured, update the setting from your Group Policy Management Console on the Domain Controller. See Configure clients using Group Policy for details.

  4. Close the file.

Export the WSUS certificate

Provision your downstream publishing servers with a WSUS certificate by exporting the certificate from the upstream WSUS server.

See Configure clients using Group Policy for details.

Import the WSUS certificate

After you export the certificate to a file, import the certificate file to both the Trusted Root Certification Authorities and Trusted Publishers stores. You can import the certificate into your GPO or perform the following steps to manually import the certificate to the PC.

  1. Log on to the computer that is receiving the certificate error.
  2. Copy the certificate to the local machine.

  3. Launch the Microsoft Management Console by executing:

    MMC.exe

  4. Click File > Add/Remove Snap-in.
  5. Select Certificates and click Add.
  6. Select the Computer account, and click Next.
  7. Select the Local Computer, and click Finish.
  8. Click OK.
  9. Place the certificate in Trusted Root CA.
    1. Expand Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates.
    2. Search the directory for a WSUS Self-Signed Certificate.

    3. Make sure the serial number is identical with the certificate you exported from the WSUS server.

      If the certificate is identical, go to step 10. If not, go to step d.

    4. Right-click Certificates under Trusted Root Certification Authorities > All Tasks > Import.
    5. Click Next.
    6. Click Browse and navigate to the directory where you copied the certificate.
    7. Select the certificate, and then click Next.
    8. Make sure the certificate is placed in Trusted Root CA, and then click Next.
    9. Click Finish.
  10. Place the certificate in Trusted Publishers.
    1. In the certificates MMC, navigate to Trusted Publishers > Certificates.

    2. Search this directory for the WSUS Self-Signed Certificate, if it is present, make sure the serial number is the same as the certificate you exported from WSUS. If it is, download the update again.

      If the serial number doesn’t match continue to step c.

    3. If it is not present, right-click Certificates under Trusted Publishers > All Tasks > Import.
    4. Click Next.
    5. Click Browse and navigate to the directory where you copied the certificate.
    6. Select the certificate, and click Next.
    7. Verify that the certificate is being placed in Trusted Publishers, and click Next.
    8. Click Finish.