This article provides the steps required to swap your WSUS self-signed certificate or your CA-private code-signed certificate in WSUS when the old certificate has expired.
On Windows Server 2012, 2012R2, and 2016, open Regedit on the WSUS server and go to:
HKLM\Software\Microsoft\Update Services\Server\Setup\
Create DWORD with value:
EnableSelfSignedCertificates = 1
Remove the old expired certificate with Powershell (ran as Admin)
Verify that there is only one copy, the expired one.
dir cert:\LocalMachine\WSUS\
Delete all certificates if there is only one copy in the location.
del cert:\LocalMachine\WSUS\*
If there are more copies on the server, follow the steps in Install the WSUS code-signing certificate with Powershell to find additional methods via PowerShell to see which certificate has the private key.
If you have imported a private CA Code-Signing certificate, you'll see three copies: one has a private key, and the others have only public keys. It may be necessary to move the "Intermediate" certificate to the "Intermediate CA" folder and place the top root under the "Trusted Root CAs" store.
on
Oct 11, 2019
05:18 AM
- edited on
May 22, 2024
12:34 PM
by
HollyM