Hi, I want to enable SSL in WSUS. The step will be generate certificate (by CA) and bind to IIS. Enable SSL in virtual root Then run the WsusUtil.exe configuressl FQDN Update the GPO to https After I run the "WsusUtil.exe configuressl" cmdlet, the WSUS only allow https? or both of http and https? Do I need to deploy the certificate to client side?

You REQUIRE to use both HTTP and HTTPS as WSUS uses both to work properly (see https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/#Non-SSL-Blocked ) To do the SSL Configuration in an easy way, review part 7 of my guide https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-7-ssl-setup-for-wsus-and-why-you-should-care/

Coexistence http and https after enable SSL in WSUS

Accepted answer

Adam J. Marshall 9,121 Reputation points MVP

2024-01-27T02:18:57.6+00:00

You REQUIRE to use both HTTP and HTTPS as WSUS uses both to work properly (see https://www.ajtek.ca/wsus/client-machines-not-reporting-to-wsus-properly/#Non-SSL-Blocked)

To do the SSL Configuration in an easy way, review part 7 of my guide

https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-7-ssl-setup-for-wsus-and-why-you-should-care/
Please sign in to rate this answer.
Chong 846 Reputation points

2024-01-29T07:30:40.57+00:00

Hi Adam, Thanks for the information. So HTTP still required when we enabled SSL. But I want to know if some computer still can get update by http if they didn't install the certificate from WSUS.As we need to enable SSL in main office, but branch office will be later.

Adam J. Marshall 9,121 Reputation points MVP

2024-01-29T15:06:11.2066667+00:00

If you do it correctly, SSL will be required when you change it. You mention branch office - if they have their own WSUS Server (replica downstream), they would be unaffected as it would only be the upstream that would change. Although, after the upstream changes, you would need to edit the WSUS sync settings (and ensure the new SSL Cert is trusted) to account for the new SSL, but that's a 1 time change and on the WSUS downstream server, not the client systems.

If you run an internal CA with an already trusted CA Root, simply use the CA to create an SSL certificate for WSUS and it will be trusted throughout the organization.

If you don't have an Internal CA, you COULD use a public Certificate that you either generate for free (let's encrypt) or that you purchase. Since it would be a public CA, it would be inherently trusted.
Sign in to comment

Share via

Coexistence http and https after enable SSL in WSUS

0 additional answers