Getting WSUS Sync error in logs

Question

Getting WSUS Sync error in logs

Garima Das 1,061

Hi experts,

I installed the SUP on the Primary Site Server, but the WCM.log is showing as below error:

and on the wsyncmgr.log , it is showing as shown below:

I had earlier configured WSUS for SSL, so I had added cert to the WSUS site, and then I had configured SSL as shown below:

but I had not configured WSUS to use SSL. The current configurations is as shown below:

Also I have configured SUP to use and download directly from Microsoft Updates.

Are these configurations causing the above errors? Or are these errors due to some other reason?

2 answers

Your answer

Answer 1

Rahul Jindal [MVP] 10,901 MVP

2 things.

Did you configure IIS to bind the cert and the WSUS web service apps?
You need to enable option 'Require SSL communication to the WSUS server'

Garima Das 1,061 Reputation points

2021-11-09T05:53:31.343+00:00

I enabled the 'Require SSL Communication to the WSUS Server'. Now it is giving another error, as shown below:

How do I proceed from here?
Rahul Jindal [MVP] 10,901 Reputation points MVP

2021-11-09T06:32:01.173+00:00

What about the WSUS web apps in IIS?
Garima Das 1,061 Reputation points

2021-11-09T06:52:58.437+00:00

I have added the cert in the WSUS Administration bindings port 8531 and then checked the apps to "Require SSL".
Rahul Jindal [MVP] 10,901 Reputation points MVP

2021-11-09T07:20:57.157+00:00

You should restart IIS for the changes to configure and then try running the WSUS sync in ConfigMgr.
Garima Das 1,061 Reputation points

2021-11-09T15:44:37.507+00:00

I restarted the IIS and then tried again. Now it is showing a different error in the logs. The error can be seen as shown below:
Rahul Jindal [MVP] 10,901 Reputation points MVP

2021-11-09T16:02:30.31+00:00

This one will require some more digging. See if you can find anything in IIS and WCM logs. Check for the ports if they are allowed in the FW or not.
Amandayou-MSFT 11,156 Reputation points

2021-11-12T04:40:14.13+00:00

Hi,

Please verify the WSUS console can connect using SSL.

Open the WSUS console to verify you can use an SSL connection to the WSUS server's ApiRemoting30 web service. We'll test some of the other web services later.

1.Open the WSUS console and select Action > Connect to Server.

2.Enter the FQDN of the WSUS server for the Server name option.

3.Choose the Port number returned in the URL from WSUSutil.

4.The Use Secure Sockets Layer (SSL) to connect to this server option automatically enables when either 8531 (default) or 443 are chosen.

5.If your Configuration Manager site server is remote from the software update point, launch the WSUS console from the site server and verify the WSUS console can connect over SSL.

If the remote WSUS console can't connect, it likely indicates a problem with either trusting the certificate, name resolution, or the port being blocked.

Thanks and regards,
Amanda

Answer 2

Hi @Garima Das ,

According to your information, we have obtained a PKI certificate and bound the certificate to the WSUS Administration website.

Here are these steps we need to do:

Configure the WSUS web services to require SSL
Configure the WSUS application to use SSL
Verify the WSUS console connection can use SSL
Configure the software update point to require SSL communication to the WSUS server
Verify functionality with Configuration Manager
If these steps have finished, the error could be disappear.

Here is the detailed information about them, please refer it:
https://learn.microsoft.com/en-us/mem/configmgr/sum/get-started/software-update-point-ssl

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Getting WSUS Sync error in logs

2 answers

Your answer