Security Compliance

Use Patch Manager with a CA-signed certificate

This article describes how to use Patch Manager with a Certificate Authority (CA) signed certificate.

First published date

11/29/2018 10:40 PM

Last published date

11/4/2020 11:32 PM

Overview

This article describes how to use Patch Manager with your own Certificate Authority (CA) signed certificate.

Product section

Patch Manager

Resolution

  1. Get a Web server SSL certificate for WSUS, and then install and configure the certificate on IIS. You can use an external CA vendor or use local Enterprise CA.
  2. Request for a CODE SIGNING certificate,  from an external CA authority (such as Verisign) or use your local Enterprise CA and save the certificate in PKCS#12 (PFX) format containing the private key. This process requires a Code Signing Certificate Signing Request (CSR) to be submitted to the appropriate CA's.
  3. Copy the PFX file to the desktop of the  WSUS server in a folder named Cert or another server used to sign the package.

  4. Copy the Solarwinds.Utilities.WSUS2012PlusCert from the Patch Manager server at location Program Files (x86)\SolarWinds\Patch Manager\Server to the same folder(cert) on the desktop of the WSUS.

    See Importing an SPC into a Certificate Store for details. (© 2017 Microsoft Corporation, available at https://www.microsoft.com, obtained on December 28, 2017).

  5. Log in to the Patch Manager server with an account that is part of the WSUS Administrators group.
  6. Open and elevated command prompt
  7. Navigate to: C:\Program Files\SolarWinds\Patch Manager\Server

  8. In the command line, execute:

    SolarWinds.Utilities.WSUS2012PlusCertManagement.exe /operation addpfx /pfxfile c:\cert_folder\my_CA_Cert.pfx /pfxfilepassword Passw0rd /targetwsusname . /targetwsusport 8531 /targetwsususessl yes

    The signed certificate is placed in the correct certificate stores for Patch Manager to detect when the WSUS server is refreshed in the Patch Manager mmc console.

This utility is available from PM server and is intended to add or remove a signing certificate(s) on WSUS servers. This utility places the signed certificate in correct certificate stores - Trusted Root and Trusted Publisher - for Patch Manager to detect when the WSUS server is refreshed in the Patch Manager mmc console.

In some cases, the publishing wizard simply ignores the Custom / Enterprise CA cert and creates a new Self-Signed WSUS cert each time the wizard is run.

As of PM 2019.4 this is flagged as bug and it will be fixed in future release and this page will be updated accordingly.