Introduction
Windows Server Update Services (WSUS) allows IT administrators to deploy the latest Microsoft product updates. By default, WSUS communicates over HTTP (port 8530), which leaves update traffic vulnerable to interception and spoofing attacks. Securing WSUS with SSL/TLS (port 8531) is a critical security best practice. This guide provides a step-by-step approach to configuring SSL/TLS on an existing WSUS deployment.
Prerequisites
Before beginning, ensure you have:
- A fully functional WSUS server (Windows Server 2016, 2019, or 2022).
- A valid SSL certificate. This can be issued by an internal Active Directory Certificate Services (AD CS) CA or a trusted third-party CA.
- Administrative privileges on the WSUS server.
Step 1: Install the SSL Certificate
If your certificate is in PFX format, you must import it into the server’s Personal certificate store. Open the Microsoft Management Console (MMC), add the Certificates snap-in for the Computer account, and navigate to Personal > Certificates. Right-click, select All Tasks > Import, and complete the wizard to import your PFX file.
Step 2: Bind the Certificate in IIS
WSUS uses Internet Information Services (IIS) to host its web services. Open the Internet Information Services (IIS) Manager. In the connections pane, expand your server name, expand Sites, and select WSUS Administration. In the Actions pane on the right, click Bindings. Add a new binding for https on port 8531 and select the SSL certificate you imported in Step 1.
Step 3: Require SSL on Specific Virtual Directories
You must configure specific WSUS virtual directories to require SSL. In IIS Manager, under the WSUS Administration site, click on each of the following virtual directories one by one:
- APIRemoting30
- ClientWebService
- DssAuthWebService
- ServerSyncWebService
- SimpleAuthWebService
For each directory, double-click SSL Settings in the middle pane, check the box for Require SSL, and click Apply in the Actions pane. Do not require SSL for the Content or ReportingWebService directories.
Step 4: Configure WSUS to Use SSL
Now that IIS is configured, you must tell the WSUS application to use the SSL configuration. Open an elevated Command Prompt (not PowerShell) and navigate to the WSUS tools directory:
cd "C:\Program Files\Update Services\Tools"
Run the following command, replacing the FQDN with your server’s fully qualified domain name that matches the certificate:
wsusutil.exe configuressl FQDN.of.your.server
Step 5: Update Group Policy for Clients
Finally, your client machines must be instructed to connect using HTTPS. Open your Group Policy Management Console (GPMC) and edit the GPO applied to your WSUS clients. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update. Locate the Specify intranet Microsoft update service location policy and change the URLs from http://FQDN:8530 to https://FQDN:8531. Force a group policy update on clients to verify connectivity.