Third-party updates in Configuration Manager: catalogs, signing certificate and errors

Configuration Manager can patch more than Windows: the Third-Party Software Update Catalogs node lets you subscribe to vendor catalogs, publish their updates to your software update point (SUP) and deploy them like Microsoft updates. Most failures come down to one thing: the certificate WSUS uses to sign that content. In this post I'll set the feature up end to end, explain the signing certificate choices, and map the common errors to their fixes.

How it works#

A third-party catalog holds update metadata. When you subscribe, the SMS_ISVUPDATES_SYNCAGENT component on the top-level SUP downloads it and syncs the metadata into WSUS, so clients can scan for applicability. When you publish an update, its binaries are downloaded from the vendor, signed with the WSUS signing certificate and stored in the top-level SUP's WSUSContent folder. Clients only install that content if they trust the signing certificate and Windows Update policy allows non-Microsoft signed updates from your intranet update server.

Prerequisites: free disk space in WSUSContent on the top-level SUP, and internet access from it to download.microsoft.com over HTTPS 443 (for the partner catalog list) and to each vendor's catalog and content URLs. Third-party sync uses the SUP's proxy settings.

Step-by-step#

1. Enable the feature and choose the certificate#

Go to Administration › Site Configuration › Sites, select the top-level site, then Configure Site Components › Software Update Point › Third-Party Updates, and select Enable third-party software updates. Then choose:

• Configuration Manager manages the certificate: the site creates a self-signed WSUS signing certificate during the next sync (logged in wsyncmgr.log). It appears as type Third-party WSUS Signing in Administration › Security › Certificates.
• Manually manage the certificate: for a PKI code-signing certificate from your own CA, installed into WSUS with System Center Updates Publisher or another tool.

2. Extra steps when the SUP is remote#

If the top-level SUP isn't on the site server, enable SSL on the SUP and WSUS with a server authentication certificate; otherwise automatic certificate management fails with Remote WSUS connection is not HTTPS in wsyncmgr.log. For a Configuration Manager-managed certificate you also need Remote Registry running on the SUP, remote registry permissions for the WSUS server connection account (shown on the SUP role's Proxy and Account Settings tab; the site server's computer account if blank) and this value on the site server:

$key = 'HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup'
New-Item -Path $key -Force | Out-Null
New-ItemProperty -Path $key -Name EnableSelfSignedCertificates -PropertyType DWord -Value 1 -Force

If that account can't administer the SUP remotely, export the certificate from the SUP's WSUS store and import it into the SUP's Trusted Publishers and Trusted Root stores yourself.

3. Turn it on for clients#

In a custom device client setting, set Software Updates › Enable third-party software updates to Yes. This sets the Windows Update policy Allow signed updates from an intranet Microsoft update service location (registry value AcceptTrustedPublisherCerts = 1) and installs the WSUS signing certificate on the client. Certificate handling is logged in UpdatesDeployment.log.

4. Subscribe to a catalog#

1. Go to Software Library › Software Updates › Third-Party Software Update Catalogs. Partner catalogs are pre-registered; for any other vendor, select Add Custom Catalog and enter its HTTPS download URL, publisher and name. Custom catalogs must use HTTPS and signed updates.
2. Select the catalog and Subscribe to Catalog. Review and approve the catalog's signing certificate.
3. For v3 catalogs, choose categories instead of the whole catalog, and keep Do not stage content, synchronize for scanning only unless you're sure you'll deploy a category.
4. Set the schedule (every 7 days by default).

5. Sync, publish and deploy#

1. Run a SUP sync so the vendor's products appear, select them on the SUP component's Products tab, and sync again. The updates show in All Software Updates as metadata-only (blue arrow icon).
2. Filter by Vendor, select the updates you need and choose Publish Third-Party Software Update Content. Follow progress in SMS_ISVUPDATES_SYNCAGENT.log on the top-level SUP (default folder C:\Program Files\Microsoft Configuration Manager\Logs).
3. Sync again: the published updates become deployable. Deploy them with a software update group or automatic deployment rule; on the Download Locations page keep Download software updates from the internet: for published third-party updates that "internet" location is your SUP, because Configuration Manager downloads their content from the WSUS content directory over HTTP.

Verify#

On a client, after a Software Updates Scan Cycle, check the policy and compare certificate thumbprints with the one in Administration › Security › Certificates:

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name AcceptTrustedPublisherCerts
Get-ChildItem Cert:\LocalMachine\TrustedPublisher | Select-Object Subject, Thumbprint, NotAfter
Get-ChildItem Cert:\LocalMachine\Root | Select-Object Subject, Thumbprint, NotAfter

Good looks like this: the value is 1, the signing certificate is in Trusted Publishers (and, if it's self-signed, in Trusted Root), WUAHandler.log lists the update as missing without download errors, and Software Center shows it installed.

Common errors#

Tips and gotchas#

• Keep old certificates on clients. Updates signed before a certificate change still need the previous certificate, or they fail with 0x800b0109.
• The console machine downloads content from WSUS into the deployment package, so it must trust the WSUS signing certificate too.
• Proxy: if the top-level SUP needs a proxy, signature checks can fail; set the WinHTTP proxy (netsh winhttp set proxy) on that server.
• SCUP-published updates: the feature can't publish content for metadata-only updates that another tool added to WSUS.
• Cloud management gateway: third-party content stored on a CMG doesn't download to clients that use delta content downloads.
• Related: SUP sync failures, updates not installing and the software update error codes quick reference.

References#

• Enable third-party updates (Microsoft Learn)
• Manage additional Windows Update settings (Microsoft Learn)
• Third-party updates fail to install with error 0x800b0109 (Patch My PC knowledge base)