How We Resolved a WSUS Update Import Failure Caused by TLS Configuration

Recently, our team worked on an issue where importing a specific update into Windows Server Update Services (WSUS) using a PowerShell script was failing.

The script was based on Microsoft's documented method for importing updates from the Microsoft Update Catalog into WSUS. Reference: WSUS and the Microsoft Update Catalog

Issue Observed

When attempting to import the update, the PowerShell script returned the following error:

Attempting WSUS update import for Update ID:

797fec39-6d79-43b7-8585-8d95c6017cc3...

Failed. Exception calling "ImportUpdateFromCatalogSite"

with "2" argument(s):

"The request was aborted:

Could not create SSL/TLS secure channel."

Root Cause

The error indicated that the WSUS server was unable to establish a secure SSL/TLS connection with the Microsoft Update Catalog.

In our environment, the issue was related to .NET Framework TLS settings. The server was not configured to use strong cryptography settings required for secure communication with Microsoft services.

Solution

We created the following registry settings to enable modern TLS protocols for .NET Framework applications:

64-bit .NET Framework / 32-bit .NET Framework

HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319

Conclusion

This issue highlights the importance of verifying TLS and .NET Framework configurations when working with WSUS update imports. A simple registry change enabled secure communication with the Microsoft Update Catalog and restored successful update imports, helping the team quickly resolve the issue without rebuilding or reconfiguring WSUS.