Support for running WSUS on SSL

[mvds-vdsc]

Hi, I use this DSCResource to deploy and maintain about 30 WSUS servers. Recently I had to put these on SSL for security compliance and can't use this resource anymore.
Currently the test to see if wsus has been configured is get-wsusserver, when the wsus server is on ssl this returns a "401 not authorized" and dsc tries to configure wsus again.

Could you add a parameter that wsus is on ssl? The test would then be get-wsusserver -usessl -name -port 8531

thanks,
Marc

[johlju]

Happy to review a Pull Request if anyone send in one with the necessary changes and unit tests for the changes.

Looks like there is need to add three parameters

        ...

        [Parameter()]
        [System.String]
        $HostName,

        [Parameter()]
        [System.UInt16]
        $Port,

        [Parameter()]
        [System.Boolean]
        $UseSsl,

        ...

Then it could be used like:

$getWsusServerParameters = @{}

if ($PSBoundParameters.ContainsKey('HostName')
{
    $getWsusServerParameters.Name = $HostName
}

if ($PSBoundParameters.ContainsKey('Port')
{
    $getWsusServerParameters.PortNumber = $Port
}

if ($PSBoundParameters.ContainsKey('UseSsl')
{
    $getWsusServerParameters.UseSsl = $UseSsl
}

Get-WsusServer @getWsusServerParameters

[Borgquite]

Are you sure you ran wsusutil configuressl <fqdn> on your WSUS server after installing the certificate?

I've been running the module with SSL enabled WSUS servers too and I don't think I needed to modify it as long as I did that first.

https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#233-configure-wsus-to-use-the-tlsssl-signing-certificate-for-its-client-connections

[Borgquite]

Follow up: Just checked my config and it works fine without modificiation provided the command above has been run.

Here's some DSC that will allow you enable SSL and run the utility. Expects WebAdminstrationDsc, and that you have defined $NodeName and $DomainName, and have the certificate installed, hopefully you can get it to work.

    WebSite "WSUS Administration" # Enable SSL certificate
    {
        Name = "WSUS Administration"
        BindingInfo =
        @(
            DSC_WebBindingInformation
            {
                Protocol = 'http'
                Port = 8530
            }
            DSC_WebBindingInformation
            {
                Protocol = 'https'
                Port = 8531
                CertificateSubject = "$NodeName.$DomainName"
            }
        )
        DependsOn =
        @(
            "[UpdateServicesServer]$NodeName.$DomainName" # Website only created when this resource runs
        )
    }

    WebApplication "SimpleAuthWebService" # Require SSL
    {
        Website = 'WSUS Administration'
        Name = 'SimpleAuthWebService'
        WebAppPool = 'WsusPool'
        PhysicalPath = 'C:\Program Files\Update Services\WebServices\SimpleAuthWebService'
        SslFlags = 'Ssl'
        DependsOn = "[WebSite]WSUS Administration"
    }
    WebApplication "DssAuthWebService" # Require SSL
    {
        Website = 'WSUS Administration'
        Name = 'DssAuthWebService'
        WebAppPool = 'WsusPool'
        PhysicalPath = 'C:\Program Files\Update Services\WebServices\DssAuthWebService'
        SslFlags = 'Ssl'
        DependsOn = "[WebSite]WSUS Administration"
    }
    WebApplication "ServerSyncWebService" # Require SSL
    {
        Website = 'WSUS Administration'
        Name = 'ServerSyncWebService'
        WebAppPool = 'WsusPool'
        PhysicalPath = 'C:\Program Files\Update Services\WebServices\ServerSyncWebService'
        SslFlags = 'Ssl'
        DependsOn = "[WebSite]WSUS Administration"
    }
    WebApplication "APIRemoting30" # Require SSL
    {
        Website = 'WSUS Administration'
        Name = 'APIRemoting30'
        WebAppPool = 'WsusPool'
        PhysicalPath = 'C:\Program Files\Update Services\WebServices\ApiRemoting30'
        SslFlags = 'Ssl'
        DependsOn = "[WebSite]WSUS Administration"
    }
    WebApplication "ClientWebService" # Require SSL
    {
        Website = 'WSUS Administration'
        Name = 'ClientWebService'
        WebAppPool = 'WsusPool'
        PhysicalPath = 'C:\Program Files\Update Services\WebServices\ClientWebService'
        SslFlags = 'Ssl'
        DependsOn = "[WebSite]WSUS Administration"
    }

    Script "WsusUtil-configuressl" # Configure WSUS to use the SSL signing certificate for its client connections - based on https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus
    {
        GetScript = {@{'Result'=&{ if(Test-Path -Path "$env:ProgramFiles\Update Services\Tools\WsusUtil.exe"){ & "$env:ProgramFiles\Update Services\Tools\WsusUtil.exe" configuressl } }}} # Return the current configuressl returned output as result
        TestScript = {&{ if(Test-Path -Path "$env:ProgramFiles\Update Services\Tools\WsusUtil.exe"){[String](& "$env:ProgramFiles\Update Services\Tools\WsusUtil.exe" configuressl) -match "$Using:NodeName.$Using:DomainName"}else{$false} }} # Is the fully qualified domain name configured?
        SetScript = {& "$env:ProgramFiles\Update Services\Tools\WsusUtil.exe" configuressl "$Using:NodeName.$Using:DomainName" | Out-Null} # If not, attempt to configure it
        DependsOn =
        @(
            "[WebApplication]SimpleAuthWebService"
            "[WebApplication]DssAuthWebService"
            "[WebApplication]ServerSyncWebService"
            "[WebApplication]APIRemoting30"
            "[WebApplication]ClientWebService"
        )
    }

[mvds-vdsc]

Hi all,
For initial setup there is no problem, the module runs, configures WSUS and afterwards WSUS is put on SSL. All is fine like that. But if you use the module to do maintenance or changes on WSUS when it is already on SSL, the module does not detect the existence of WSUS, which is logic because when I dig into the test to see if there is a wsus server, the test only consists of get-wsusserver while if it is on ssl you need to have extra parameters. So basically, the module tries to configure WSUS again instead of just pushing the changes. I could be missing something as well

[Borgquite]

Hi @mvds-vdsc, completely understand where you're coming from. However in testing Windows Server 2022 with WSUS and SSL enabled at least, I don't have to provide any extra parameters for Get-WsusServer provided I've run the wsusutil configuressl <fqdn> command on the server itself.

Running that command informs the relevant PowerShell APIs that SSL is required and it automatically connects to the local server. You only need to specify port numbers and SSL usage if you are connecting to a remote server (which isn't supported in this module at present).

Could you run this command (in an elevated Command Prompt) and share the output?

"C:\Program Files\Update Services\Tools\wsusutil.exe" configuressl