This is arguably common sense, but sometimes simple things are overlooked.
Recently our SSL certificate expired for WSUS. Symptom was the SCCM reports website giving SSL untrusted message, event logs on clients tossing SSL errors. SWPM admin console could not expand update services node without giving SSL/TLS errors.
Quickly identified the expired cert lived on IIS. We issued and loaded new cert to IIS and added binding to the default web site for port 443. SCCM reporting started working again.
Next day noticed SWPM still tossed SSL/TLS errors and that systems were not seeing any WSUS updates. Did some quick checks and didn't notice any issues right away. Finally broke down and opened ticket with SW support.
Ten minutes later after some more searching checked the WSUS Administration site and saw that there was no cert binding for port 8531. Added the cert and things were working again.
Ticket was then closed.
