Hi, We have WSUS server which download patch from another WSUS upstream server. Now we plan to move the WSUS server to SCCM server and running in SSL between upstream server, SCCM and client machine. All certificates will be generated by an internal enterprise CA server. To enable SSL between SCCM and upstream server, is it install a certificate (common name is upstream server) in the upstream WSUS server? To enable SSL between client and SCCM server, is it install another certificate (common name is SCCM server) in SCCM server? Thanks

Hi, @ Chong Thank you for posting in Microsoft Q&A forum. To enable SSL between SCCM and upstream server, you need to install a server authentication certificate generated from the internal certificate authority. To enable SSL between client and SCCM server, you need to install another server authentication certificate generated from the internal certificate authority. For more reference: Configure SSL on WSUS Plan for software updates in Configuration Manager Configure client computers to establish SSL connections with the WSUS server If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".

Enable SSL with SCCM, upstream WSUS server and client machine.

Accepted answer

AllenLiu-MSFT 46,451 Reputation points Microsoft Vendor

2023-11-06T03:10:19.6333333+00:00
Hi, @Chong

Thank you for posting in Microsoft Q&A forum.

To enable SSL between SCCM and upstream server, you need to install a server authentication certificate generated from the internal certificate authority.

To enable SSL between client and SCCM server, you need to install another server authentication certificate generated from the internal certificate authority.

For more reference:

Configure SSL on WSUS

Plan for software updates in Configuration Manager

Configure client computers to establish SSL connections with the WSUS server

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".
Please sign in to rate this answer.
Chong 866 Reputation points

2023-11-06T03:24:46.2033333+00:00

Hi @AllenLiu-MSFT

I will install server authentication certificate from the CA. But my concern is which certificate need to installed.

If my upstream server's name is "up.abc.com" and SCCM server is "cm.abc.com":

The upstream server will install a certificate name "up.abc.com" and the SCCM server will install a certificate name "cm.abc.com"?

Thanks

AllenLiu-MSFT 46,451 Reputation points Microsoft Vendor

2023-11-06T08:44:16.3+00:00

Hi, @Chong

You may follow this article for the steps:

https://kc.jetpatch.com/hc/en-us/articles/360043618872-Enabling-SSL-on-WSUS-

Chong 866 Reputation points

2023-11-06T09:00:10.4733333+00:00

@AllenLiu-MSFT,

I understand I need to generate certificate in WSUS and deploy to client.

As we have "3 tier" in WSUS: Upstream > WSUS > client:

I need to create the first certificate in Upstream server, then bind it in Upstream's IIS server and deploy it to WSUS server.

Then I need to create the second certificate in WSUS server, then bind it in WSUS IIS server and deploy it to client machine.

Right?

AllenLiu-MSFT 46,451 Reputation points Microsoft Vendor

2023-11-07T08:09:45.72+00:00

Hi, @Chong

According to below article, it seems we do not need to deploy the certificate to WSUS server or client machine.

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/security-best-practices-for-windows-server-update-services-wsus/ba-p/1587536
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Enable SSL with SCCM, upstream WSUS server and client machine.

0 additional answers

Your answer