SOLVED Software Updates deployment failing - Scan Failed with Error=0x80240440

[aanwar]

Hello,

I am running SCCM 1902 and recently the software deployment started to go in unknown status. I tried to dig in the logs and found multiple errors. Please see the attached logs. So far, I have removed the SUP and uninstalled WSUS and re-installed both. The problem still persists.

 

[Prajwal Desai]

What the version of Windows Server ?.

 

[aanwar]

Hi Prajwal,

I am running Server 2012R2. I happened to find the problem. The SUP properties had the box ticked to require SSL communication to the WSUS server. I had recently set up the third-party updates and part of the configuration required to enable this.

 

[anthonius.uk]

Experiencing this exact issue, but with Server 2016 and SCCM 1906. I have just set up SCUP for Adobe and HP updates and updates stopped working across the board. My log files have identical errors to the attached logs above. Did you find a solution Aanwar?

 

[aanwar]

My solution was to uncheck the require SSL for WSUS. I had enabled the third party updates and part of it required to make a configuration change on the SUP properties where you have to check Require SSL for WSUS server. I unchecked it and the updates went through. For the third party updates, I still need to work on getting the certificate assigned properly.

 

[anthonius.uk]

That seemed to resolve the immediate issue. I think I'm going to need to spend some time reading up on enabling SSL for WSUS.
Onto the next issue (drivers not showing new version after scupdate). Fun fun fun
Thanks for responding so fast

 

[ronvanloo]

Hello
Yesterday I also enabled third party and I also had to check the SSL for WSUS.
The third party is working great because I was looking for Adobe Reader DC updates.
But this morning I discovered the same error 0x80240440 on all the clients.
So I disabled the SSL for WSUS and the error disappeared.
Is there something I forgot or is it a firewall issue.
Any help would be great.
Regards,
Ron.

 

[hadjer.YH]

Hello,
I have the same issue, any update please for solution without uncheking the ssl requiered for WUSU thir party requests.

Regards,
HAdjer YH

 

[Edy]

how did you guys setup the certificate for WSUS? are you using self signed or certificate from your internal CA?

Check WUAHandler.log on your client to check the url of the server your client is using, i believe in this instance is https://blablabla. copy the url and paste on the client browser and check if the certificate is trusted on your browser. if its not then you have a certificate trust issue.

it can be either the certificate doesnt match the url name or the certificate chain doesnt exist on your client.

i would recommend to generate certificate from your internal CA to be used on your WSUS server.

 

[Edy]

on another note, check your client's registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ and see whether your WUServer key is pointing to http or https

 

[ronvanloo]

how did you guys setup the certificate for WSUS? are you using self signed or certificate from your internal CA?

Check WUAHandler.log on your client to check the url of the server your client is using, i believe in this instance is https://blablabla. copy the url and paste on the client browser and check if the certificate is trusted on your browser. if its not then you have a certificate trust issue.

it can be either the certificate doesnt match the url name or the certificate chain doesnt exist on your client.

i would recommend to generate certificate from your internal CA to be used on your WSUS server.

I used self signed certificate. Is this not okay?

Regards,
Ron.