!This post hasn't been updated in over 1 year. The information contained within may no longer be accurate, or let alone work. You're welcome to contact me if you'd like an update. Note: Not all posts will (or can) be updated.

I have a fairly popular post on here regarding pushing out Java via WSUS. In the previous post, I used LUP or Local Update Publisher. Now, LUP was a good tool however it appears to be no longer updated and it’s a little clunky so it takes some time to properly use and setup. Now, I’ve since moved over to PDQ Deploy from Admin Arsenal. It’s a fantastic product and I’d highly recommend using it (including the free mode) in addition to WPP. So let’s get down to business.

Generate your Code Signing Certificate

Since we’re going to need to sign code, we need to generate ourselves a code signing certificate and push this certificate out to our users so they’ll be able to install our custom packages. You do need to have an enterprise CA in your Active Directory domain!

Open the Certification Authority console and connect to a CA in your AD domain (I always recommend using RSAT over logging into the actual machine whenever and wherever possible).
Navigate to Certificate Templates and see if you have a code signing certificate. In this case, I do not have one so we need to generate one.
If you don’t have a Code Signing template, let’s create it. Alternate click on Certificate Templates, then select New and Certificate Template to Issue.
Select Code Signing and then click OK.
Now we need to request a Code Signing certificate from our CA. So open up MMC and add the Certificates Snap-In. Your account should have administrative rights or you’re going to need to do this from a Domain Administrator account. Expand Personal, and then alternate click on Certificates. Select All Tasks, Request New Certificate.
Select Active Directory Enrollment and then select the Code Signing certificate template. Click on Details and then the Properties button.
Click on the Private Key tab and tick the options to make the private key exportable (THIS IS IMPORTANT!) and enable strong private key protection.
Click on the Enroll button. If you get a message like the following, just click on OK.
If everything worked correctly, you should get a success message.
Now we need to export our certificate so we can use it and sign some code! In the MMC, go to your personal certificates and find the code signing certificate you just generated. Select it, alternate click, select All Tasks, and Export…
Walk through the export wizard. Be sure to export the private key! Also, remember to set a password you can remember. If you can’t you’ll have to re-export your certificate and private key.
Now we have to import the key into the WSUS Package Publisher console so it can sign the packages. Now this is where it gets tricky. WPP wants you to enter the PFX password before it will let you browse for the PFX which is why I got frustrated.
Now we need to distribute the key. For testing, you can import it locally on your machine (or if your network is small enough) otherwise for distribution, do it through Group Policy. Be sure to re-export the certificate without the private key (just as a CERT or CER file).
1. Open a GPO or create a new GPO.
2. Expand Computer Management, Policies, Windows Settings, Security Settings, Public Key Policies.
3. Alternate click on Trusted Publishers and select Import…
4. Use the wizard to import the PFX (certificate with private key) and enter the password for the PFX.
Now you’re set! You can start publishing custom packages!Documentation is on the WPP site.