Overview

• In this video guide, we will cover how you can use a code-signing certificate from an Active Directly Certificate Services infrastructure or using a public certificate authority such as DigiCert for signing third-party software updates in Microsoft System Center Configuration Manager (SCCM). Using a trusted PKI based code-signing certificate can be an alternative to using a self-signed certificate.

Topics in Video

• Create the code-signing certificate templates needed for the WSUS signing feature – https://youtu.be/lqapp8j7CHk?t=34
• Issuing the certificate template for deployment – https://youtu.be/lqapp8j7CHk?t=188
• How to request the cert from a machine – https://youtu.be/lqapp8j7CHk?t=206
• Exporting the requested certificate to a PFX file – https://youtu.be/lqapp8j7CHk?t=280
• Review the Configuration Manager 1806 option to allow ConfigMgr to manage the WSUS certificate – https://youtu.be/lqapp8j7CHk?t=327
• Importing PFX file to WSUS using the publishing service – https://youtu.be/lqapp8j7CHk?t=394
• Sync the SUP and review wsyncmgr.log to verify ConfigMgr received the imported code-signing PFX certificate- https://youtu.be/lqapp8j7CHk?t=460
• Add catalog and publish a third-party update to verify the .CAB file is signed using the PFX certificate – https://youtu.be/lqapp8j7CHk?t=536
• Switch to use a third-party code-signing certificate from DigiCert – https://youtu.be/lqapp8j7CHk?t=670
• Verify SCCM switches from using the code-signing certificate from AD CS to DigiCert’s code-signing certificate – https://youtu.be/lqapp8j7CHk?t=715

Helpful Resources:

• Publishing Service Download – https://patchmypc.com/publishing-service-setup-documentation
• System Center Updates Publisher Download – https://www.microsoft.com/en-us/download/details.aspx?id=55543
• Enable third-party updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates
• Automatically manage the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#automatically-manage-the-wsus-signing-certificate
• Manually manage the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#manually-manage-the-wsus-signing-certificate
• Manually manage the WSUS signing certificate – https://patchmypc.com/publishing-service-setup-documentation

Overview In this video guide, we will walk through the process of enabling third-party software updates in the SCCM technical preview 1806. Topics in Video

• Review code-signing HTTPS WSUS requirements – https://youtu.be/dCj4P2PdDNg?t=39
• Enable third-party Updates in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=79
• Enable HP Catalog – https://youtu.be/dCj4P2PdDNg?t=173
• Force Sync of HP Catalog – https://youtu.be/dCj4P2PdDNg?t=246
• Enable HP Vendor and Products in Software Update Point – https://youtu.be/dCj4P2PdDNg?t=417
• Download Published Update in SCCM Console – https://youtu.be/dCj4P2PdDNg?t=605
• Configure Third-Party Updates with SUP in HTTP Mode – https://youtu.be/dCj4P2PdDNg?t=720
• Generate WSUS Self-Signed Cert Using Patch My PC Publishing Service – https://youtu.be/dCj4P2PdDNg?t=761
• Import Patch My PC Update Catalog in the Catalog in SCCM – https://youtu.be/dCj4P2PdDNg?t=840

Resources for This Guide:

• Download Patch My PC Publishing Service to Generate Self-Signed Certificate – https://patchmypc.net/publishing-service-setup-documentation
• Setup Guide for Exporting Code-Signing Cert and Deploying to Client – https://patchmypc.net/publishing-service-setup-documentation

 

Overview

• In this video guide, we will be covering how to configure the third-party software update catalogs feature added in SCCM 1806. This video guide covers enabling your software update point for third-party software updates, setting Configuration Manager to manage the certificate, enabling the client setting to enable third-party software updates and configure the Patch My PC Update Catalog in the third-party software update catalog node of SCCM.

Topics in Video

• Enable the “Enable third-party software updates” in the “Third Party Updates” tab of the Software Update Point – https://youtu.be/rBdmWbf5Vgg?t=41
• Configure Configuration Manager to manage the WSUS signing certificate – https://youtu.be/rBdmWbf5Vgg?t=68
• Enable the client setting “Enable third party software updates” – https://youtu.be/rBdmWbf5Vgg?t=190
• Review the process of Configuration Manager creating the code-signing certificate for WSUS – https://youtu.be/rBdmWbf5Vgg?t=222
• Enable Patch My PC Trial Catalog as a Custom Catalog – https://youtu.be/rBdmWbf5Vgg?t=305
• Review the SMS_ISVUPDATES_SYNCAGENT.log to see the catalog being published – https://youtu.be/rBdmWbf5Vgg?t=387
• Sync the SUP and Enable Patch My PC updates in the Products tab of the SUP – https://youtu.be/rBdmWbf5Vgg?t=428
• Enable Patch My PC Catalog for a Specific Product (Oracle Java Only) – https://youtu.be/rBdmWbf5Vgg?t=485
• Enable Patch My PC Full Catalog for Publishing – https://youtu.be/rBdmWbf5Vgg?t=629
• Publish Third-Party Update Content from the SCCM Console – https://youtu.be/rBdmWbf5Vgg?t=755
• Review SCCM Third-Party Update Catalogs compared to our automated publishing service – https://youtu.be/rBdmWbf5Vgg?t=854
• Deploy the third-party software updates using an automatic deployment rule – https://youtu.be/rBdmWbf5Vgg?t=962
• Review client and verify it received the WSUS certificate and third-party update policy – https://youtu.be/rBdmWbf5Vgg?t=1042
• Verify client updates Java 8 Update 171 to Java 8 Update 181 – https://youtu.be/rBdmWbf5Vgg?t=1100

Topics Mentioned in Video

• Patch My PC Third-Party Update Catalog – https://patchmypc.net/third-party-patch-management-sccm-scup-catalog
• Trial Catalog Overview: https://patchmypc.net/scup-catalog-trial
• Trial Catalog Download URL for SCCM Catalog: https://patchmypc.net/trial-catalog-download
• Selectively Choose Products to Import Using Patch My PC Update Catalog: https://patchmypc.net/selectively-choose-products-to-publish-patch-my-pc-update-catalog
• Patch My PC Update Catalog Supported Products: https://patchmypc.net/supported-products-scup-catalog

Helpful Resources:

• Enable third-party updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates
• Prerequisites to Enable third-party updates  – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#prerequisites
• Additional requirements when the SUP is remote from the top-level site server – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#additional-requirements-when-the-sup-is-remote-from-the-top-level-site-server
• Enable third-party updates on the SUP – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#enable-third-party-updates-on-the-sup
• Configure the WSUS signing certificate – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#configure-the-wsus-signing-certificate
• Enable third-party updates on the clients – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#enable-third-party-updates-on-the-clients
• Add a custom third-party software update catalog – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#add-a-custom-catalog
• Subscribe to a third-party catalog and sync updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#subscribe-to-a-third-party-catalog-and-sync-updates
• Publish and deploy third-party software updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#publish-and-deploy-third-party-software-updates
• Monitoring progress of third-party software updates – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#monitoring-progress-of-third-party-software-updates
• Known issues – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#known-issues
• Status messages for third-party software updates in SCCM – https://docs.microsoft.com/en-us/sccm/sum/deploy-use/third-party-software-updates#status-messages