WSUS SSL Configuration: Enabling a Secure Connection

Enabling SSL on WSUS

Enabling SSL on WSUS encrypts the traffic between your client machines and the WSUS server, which matters if update traffic crosses an untrusted network or if your security policy simply requires it. It’s a bit more involved than a typical IIS SSL binding because WSUS also needs its own configuration updated to match — binding a certificate in IIS alone isn’t enough. The general process:

1. Obtain and install a certificate (from an internal CA or a public one) for the WSUS server’s fully-qualified domain name.
2. Bind that certificate to the WSUS website in IIS on the appropriate port.
3. Run the WSUS configuration tool (wsusutil configuressl <servername>) so WSUS itself knows to use SSL for client communication, not just IIS.
4. Update your Group Policy (or other WSUS client configuration) to point clients at the HTTPS URL for the WSUS server.

Because the exact IIS binding steps can vary slightly between Windows Server versions, and because getting the certificate’s subject name and the WSUS server’s configured name mismatched is the most common cause of client-side failures afterward, double-check that the certificate’s subject/SAN exactly matches the server name your clients are configured to contact before rolling the change out broadly.

Worth Knowing: WSUS Is Deprecated, But Still Fully Functional (Updated for 2026)

Microsoft declared WSUS deprecated (“no new investment”) back in September 2024, but as of 2026 it remains fully functional and supported on Windows Server 2016 through Server 2025 with no removal date set — so enabling SSL on an existing WSUS deployment, as covered here, is still a legitimate and worthwhile hardening step if you’re keeping WSUS running. Microsoft is steering new deployments toward Windows Autopatch/Intune and Azure Update Manager instead, so if you’re standing up patch management from scratch today, it’s worth weighing those options before investing further in a WSUS-based setup.

Resources

• Enabling SSL on Windows Server Update Services (WSUS)
• WSUS
• group policy