Purpose
If you have created your code signing certificate using an internal CA, the Shavlik/Ivanti Patch for SCCM plugin gives you the ability to import this certificate via the Patch Settings on the WSUS Server tab. However, to be able to use the import function, a SSL connection to the WSUS server is required . As part of the SSL configuration, another type of Server certificate, a SSL Server Certificate, is needed for the secure communication between the SCCM and the WSUS servers. Before configuring IIS to use SSL on your WSUS server, you need to create a self signed SSL certificate or request a SSL certificate.
Ivanti support does not provide support for Microsoft products such as Configuration Manager, WSUS, or IIS. If you face trouble in setting up these prerequisites to installing or configuring the Shavlik Patch plugin, you should contact Microsoft Support directly.
Description
Before following the steps using the Microsoft Web links below, the IIS role should enabled and functional.
- Create a self signed certificate using instructions at Create a Self-Signed Server Certificate in IIS 7 or if using PKI, Designing and Implementing a PKI: Part IV Configuring SSL for Web Enrollment and Enabling Key Archival
- Configure WSUS to use SSL using instructions at How to Configure the WSUS Web Site to Use SSL
- Export the SSL Certificate using instructions found at Export a Server Certificate (IIS 7) .
- Copy the certificate to your SCCM system(s) that will need to connect to the WSUS server, and ensure that this certificate is imported to the Trusted Root Certification Authorities > Certificates on any of those systems.
After the above Microsoft environmental prerequisites are met, configure the Shavlik/Ivanti Patch Plug-in to connect to the WSUS Server over SSL .
- In the SCCM Console, select Software Library > Software Updates > right click on 'Shavlik/Ivanti Patch', then choose Settings.
- Select the WSUS Server tab, choose Port 8531 and check the box for 'Use Secure Sockets Layer (SSL) to connect to this server. Test the connection, and click the 'Import' button to import your code-signing certificate.
Additional Information
For more information refer to the following resources:
- Configuring Server Certificates in IIS 7
- TechNet - Secure the WSUS 3.0 SP2 Deployment
- Microsoft's documentation on System Center 2012 at http://technet.microsoft.com/en-us/library/hh546785.aspx
- Shavlik Patch for Microsoft System Center Documentation
Affected Product(s)
Shavlik Patch for SCCM
Ivanti Patch for SCCM