[Solved] SCUP to work with WPP ?

Topics: Configuration Issue
Aug 13, 2013 at 5:32 PM
Hi Team,

Can we associate SCUP 2011 ( System Center Update Publisher ) with WPP ? We did a test, but unable to deploy updates from Adobe Reader and Flash player.

Our set-up is that, SCUP will download updates and we will approve it in WPP. Adobe updates are visible to WPP, we are able to approved it but updates are not being installed to our client machines.

When we revised updates, we are getting error :

Verification of file signature failed for file: \WSUSServer\UpdateServicesPackages\07151137-3b83-4064-8fc2-7bf983d6b08b\9634ef01-54b0-46d3-b8d3-c5f3def701ed_1.cab.

The certificate was generated by WPP and imported to Trusted Root Certification Authorities and Trusted Publisher.

Please advise if this is possible. Thanks!

Our WSUS server was able to push WINDOWS update successfully.
Aug 13, 2013 at 7:51 PM
Hi cjp_21,

Let's see if I have well understood your situation ?

You have Scup installed, and you have published, with SCUP, a package for Adobe Reader. Scup had his own Code-Signing certificate, so it has signed the package.
Then you have installed WPP, generate a new Code-Signing certificate (Does WPP ask you to do that ???). And now you try to revise the package that was signed with the first certificate while using the second certificate ?
I'm right ?
Aug 13, 2013 at 9:03 PM
Hi DCourtel,

Yes you're correct. We have SCUP installed to download non-MS updates. As of now, we are using LUP to approved those updates in WINDOWS Server 2008 but since we are planning to upgrade to WINDOWS Server 2012, we are now trying WPP as LUP does not work in WINDOWS SERVER 2012. we are still in testing stage. We have WINDOWS Server 2012 with WSUS, SCUP and WPP installed.

We only used 1 certificate. We tried certificate generated from WPP then imported it to SCUP and vise versa, we received same error, we cannot generate 2 certificates in WSUSServer\WSUS certificate folder since it will only overwrite the certificate in it.

We only tried to revise the package to check its content since it wasn't pushed to our clients.

We also tried to expire the package but we received the same error.

Aug 14, 2013 at 4:50 AM
each time you change certificat, you need to resign already published packages.
Right-click on a package and choose resign. Ensure that the certificate that is currently in the 'Wsus' store in the certificat magazin is the one that is used by clients computer.
Aug 14, 2013 at 7:11 PM

We already resigned the previous packages and downloaded new package using the present certificate in WSUS folder, also imported in Trusted Root Certification Authorities and Trusted Publisher on our client machines but without success.

And also AcceptTrustedPublisherCerts = 1 for client machine,

We tried your instruction in creating updates ( Adobe Flash Player) and it was successfully published on our client machines.

Do you think, SCUP cannot associate with WPP, for now? Have you heard with anyone who successfully set-up WSUS, SCUP and WPP ?

The good thing with SCUP is that you don't need to manually provide the information for the updates, but if this will not work, we will use WPP only. Thanks!
Aug 15, 2013 at 5:59 AM
Honestly, I never used SCUP. But in my opinion, SCUP works like WPP. These two Tools use Wsus API and the Wsus certificate. So they should works together with Wsus.
The good thing with SCUP is that you don't need to manually provide the information for the updates
You mean that you import catalogs from third-party vendors ?
If yes, I'm nearly ready to add this feature to WPP. I need to make some test in real world, so if you can give me links where I can download catalogs (I'm already aware of Dell, HP, and Adobe).

May be that other WPP users have successfully set SCUP, WPP and Wsus...
Marked as answer by DCourtel on 10/5/2013 at 5:25 AM
Aug 15, 2013 at 2:17 PM
SCUP has catalogs for Adobe, DELL, Fujitsu and HP.

This is what I found in SCUP:

adobe Flash : http://fpdownload.adobe.com/get/flashplayer/current/licensing/win/AdobeFlashPlayerCatalog_SCUP.cab_
Adobe Reader : http://armmf.adobe.com/arm-manifests/win/SCUP/Reader10_Catalog.cab
Adobe Acrobat : http://armmf.adobe.com/arm-manifests/win/SCUP/Acrobat10_Catalog.cab
DELL Client : ftp://ftp.dell.com/catalog/DellSDPCatalogPC.cab
DELL servers : ftp://ftp.dell.com/catalog/DellSDPCatalog.cab
Fujitsu : https://support.ts.fujitsu.com/GFSMS/globalflash/FJSVUMCatalogForSCCM.cab
HP client : ftp://ftp.hp.com/pub/softlib/software/sms_catalog/HpCatalogForSms.latest.cab
HP server : ftp://ftp.hp.com/pub/softlib/software10/COL25555/sy-65640-1/ProLiant.cab
HP Proliant : ftp://ftp.hp.com/pub/softlib/puc/hppuc.cab

Once we publish the updates from SCUP, it will be visible to WPP.

With SCUP, we don't need to create the updates manually, Product Name, Description, Support and Info URL, Security Bulletin ID and KB Article are already fill out.
We will check again, and maybe have a fresh installation on our servers since we did several changes on the server.

Aug 16, 2013 at 7:26 AM
Thanks for these links.