Enabling SSL on Windows Server Update Services (WSUS)

Here are the steps to configure SSL on your servers running the Windows Server Update Services. This guide was written using Server 2012 R2, however it should be the same steps for Windows Server 2008 R2 as well.  This guide also assumes you have a working instance of WSUS installed and configured, using default ports.

1. Login to your WSUS server
2. Open up Server Manager
   
3. Select Tools -> Internet Information Services (IIS) Manager
   
4. Generate a SSL certificate
   1. Click on your Server and select Server Certificates
      
   2. If you have your own PKI environment, follow these steps, if not, jump to step three
      1. Click Create Domain Certificate on the right side
         
      2. Fill in the requested information on the Distinguished Name Properties page and click Next
         
      3. Select your certificate authority and enter a friendly name (this can be anything), and then click Finish
      4. 
   3. If you need to submit a certificate request to an external certificate authority like Goaddy, Verisgn, Comodo; follow these steps
      1. Click Create Certificate Request on the right side
         
      2. Fill out the Distinguished Name Properties and click Next
         
      3. Change the Bit length to 2048 and click Next
         
      4. Select a location on where to place the CSR file that will be generated by the wizard and click Finish
         
      5. At this point, send the request to your certificate authority (like GoDaddy, Verisign, or your own internal certificate authority). You should receive back a .cer file once the claim has been fulfilled.
      6. Click on Complete Certificate Request on the right side
         
      7. Select the .cer file that your public certificate authority provided you, type in afriendly name (this can be anything), select Web Hosting for the certificate store, and click OK
         
5. Next, we need to bind the SSL certificate to your network adapter.
   1. Expand your server, expand Sites, and select WSUS Administration
      
   2. Select Bindings… on the right side
      
   3. Select the https site and hit the Edit… button
      
   4. Select https for the type, select the SSL certificate you created above, and click OK
      
   5. Click Close on the Site Bindings window
      
6. Next, we need to enforce SSL encryption on the following virtual roots
   • ApiRemoting30
   • ClientWebService
   • DSSAuthWebService
   • ServerSyncWebService
   • SimpleAuthWebService
   1. Expand WSUS Administration and foreach of the directories above, complete the following steps
      1. Select the virtual site
         
      2. Double click on SSL Settings
         
      3. Check Require SSL and leave client certificates to ignore
         
      4. Click Apply in the top right corner
         
7. Next, we need to execute a command to tell WSUS to use ssl
   1. Open up an elevated command prompt
      
   2. Navigate to your WSUS installation folder
      1. cd “c:\Program Files\Update Services\Tools”
         
   3. Execute the following command (replace your server with the correct FQDN)
      1. WSUSUtil.exe configuressl myserver.mydomain.local
8. Restart the WSUS server to make sure all changes take effect.  You should be able to bring up the WSUS management console if all went well.
9. Configure your clients to connect via SSL to the WSUS server via Group Policy
   1. Login to your domain controller
   2. Open up Server Manager
      
   3. Open up Group Policy Management
      
   4. Right click on the policy you want to edit and select Edit
      
   5. Expand Computer Configuration -> Polices -> Administrative Templates ->Windows Components -> Windows Update
   6. Double click on Specify intranet Microsoft update service location
      
   7. Change the intranet update service url to https and specify port 8531 and then clickApply.
      

That should do it!  Try doing a gpupdate /force on your local machine and the check for windows updates.  If windows successfully completes checking for updates, you should be good to go! 

Notes: Official documentation from Microsoft in regards to using SSL and WSUS can be found here: http://technet.microsoft.com/en-us/library/hh852346.aspx#consswsus

This entry was posted in Uncategorized and tagged Server 2008 R2, server 2012 r2, ssl, Windows Server Update Services, wsus on November 6, 2013 by Jack.