Problem to connect to WSUS using SSL

I've installed a certificate on the WSUS server and I've the following error when I try to update the Server registration is EminentWare:
"The remote certificate is invalid according to the validation procedure".

The certificate is sign by an internal PKI, the parent certificate chain is published in the trusted root certificate.
I don't have any error when I'm connecting to the WSUS Server with the WSUS Admin Console using SSL.

Filed under: SSL, Certificate, WSUS

Find more posts tagged with

Accepted answers

All comments

solarwinds-admin

Hi,

please contact Customer Support with your contact information and we will follow up.

Let us know if this WSUS server and the EminentWare server are on the same server.

Several things can cause this...

1) Is the root signing certificate in the trusted root certificate authorities so the chain of trust can be verified?

If not, then this needs to be added. If so, this is not your problem.

2) What is the issued-to name for the WSUS SSL certificate?

Compare this to the name used to register (and connect) to the WSUS server in the EminentWare console.

If they do not match, then this can cause a handshake error.

If this is the case, then delete the WSUS server from the EminentWare console. This can be done by selecting the Update Services node and selecting the server in the middle result pane. Once selected, a delete action will be availabile in the selection object actions in the bottom right. Select this action. Once this is complete and the WSUS Server is removed, re-register the WSUS server with the same name in the issued-to name in the certificate.

solarwinds-admin

In fact I think the problem is that the certificate is using the FQDN and the test is done with the server name.

After doing the solution 2 and register again by entering the FQDN as server name now I've got a reminder telling me to add my server (with its FQDN name) to a management group. It's already in the management group but with its short name and it's not possible to add it with its FQDN.

The application seems to not handle very well short name and FQDN...

solarwinds-admin

Hi,

delete the WSUS server from the management group and then reassign it. Once you have done that and scheduled the inventory, the reminder should go away.

solarwinds-admin

I've already done that. The reminder is still there.

The problem is that I've registered the server name for the update service with its fqdn "pwsus01.emea.cegedim.grp" (to be compatible with the certificate). When I want to add it in the management group it only propose me its short name "PWSUS01". When I assign it, it continues to remind me to add "pwsus01.emea.cegedim.grp" which is the same server !!

So for the moment either the SSL is working either I have the reminder but not both !