1024 bit certificates and the WSUS self signed certificate for 3rd party applications

Question

For the upcoming 1024 bit certificate patch coming from Microsoft will those of us that are using Patch Manager for 3rd party applications have to issue another certificate if/when we patch our workstations and servers? In the meantime, we should probably not approve the patch if we are publishing 3rd party applications and still using the 512 byte WSUS self signed certificate.

David_Di_Blasio · Accepted Answer

Lawrence Garvin did a nice write up on the impact, and steps to mitigate issues related to the upcoming certificate invalidation.

http://thwack.solarwinds.com/community/application-and-server_tht/patchzone/blog/2012/07/31/3rd-party-updates-with-wsus-local-publishing-recent-microsoft-certificate-changes-may-break-your-process-if-left-unpatched

TLDR- You'll need to remove all previously published third party content from wsus and republish after generating your 2048-bit self signed certificate.

1024 bit certificates and the WSUS self signed certificate for 3rd party applications

Top Replies