wsusscn2.cab Digital signature validation failed

[ps1705]

When I try to “Download Microsoft offline scan file” to my internet connected BP Host, I get the following error repeatedly:

Failure (Attempt 1: Failure: The underlying connection was closed: An unexpected error occurred on a receive.. HRESULT: -2146233079. Attempt 2: Failure: The underlying connection was closed: An unexpected error occurred on a receive.. HRESULT: -2146233079. )

Since that wasn’t working, I downloaded the wsusscn2.cab file directly from MS. Then I right-clicked on it and viewed ‘Properties > Digital Signatures.’ The Digital Signatures tab was present and the signature was ok.

I am using cached and offline mode. I transferred the wsusscn2.cab file to my offline BP Host. When I try to run “Retrieve consolidated url list of available updates,” I get:

WsusScn2.cab signature validation failed

I also compared the digital signature on the wsusscn2.cab file from I used in July to the one I just downloaded. The new one does have a newer digital signature. I don’t know if that is relevant.

Do you know why this isn’t working?

[doug]

1. Regarding the errors when attempting to download the file in BatchPatch… We occasionally see errors or hear of similar errors from other users. All indications generally always point to Microsoft servers. Any issue that we have ever seen ourselves or had reports of is always transient. Usually the only time we see any such errors on Patch Tuesday when it’s very soon after Microsoft has published the WsusScn2.cab file for the month. Typically we do not see or hear of any issues late in the month.

2. With regard to the difference between downloading manually and downloading through BP. There shouldn’t be any difference between these methods as we are just doing a standard file download inside the software. However, if you are using a proxy for internet access, there is a good chance that it could explain the difference between doing a manual download vs downloading inside of BP. That is, the proxy settings may not be active for the BP download even though they are active for the manual download. See link below where it describes WinHTTP proxy configuration using NETSH.

Using BatchPatch with an Enterprise Web Proxy

3. If you manually downloaded the WsusScn2.cab file, and if it has a valid digital signature, then it should work fine in BatchPatch. Make sure you have UNchecked the setting ‘Do not download newest wsusscn2.cab file if any version is already cached’ in ‘Tools > Settings > Windows Update’. If that setting is enabled, then the new WsusScn2.cab file that you manually downloaded will not get copied to target computers if the previous corrupt version is already on the target computers.

4. Make sure you are putting the WsusScn2.cab file in the correct place. Make sure it is in the directory where BP is looking for it, which is the ‘Local update cache directory’ that is defined under ‘Tools > Settings > Windows Update’.

5. If you receive the error again look at the target computer’s remote working directory (default is C:\Program Files\BatchPatch) and make sure that it has the latest WsusScn2.cab file with valid signature and isn’t for some reason still caching the older corrupt version. Unchecking the setting described above in step 3 would/should resolve any such issue, but I don’t know if possibly there is something else going on or going wrong here. You can certainly always then just delete the WsusScn2.cab file from the target computer’s working directory so that BatchPatch freshly copies the file from the local update cache directory.

[ps1705]

Thanks Doug.

2) I am not using a proxy.
3) I had already UNchecked the setting ‘Do not download newest wsusscn2.cab file if any version is already cached’ as described.
4) The WsusScn2.cab file is in the correct place.
5) I checked C:\Program Files\BatchPatch on the target computer. The old WsusScn2.cab file was there. I deleted it and ran “Retrieve consolidated url list of available updates” again. I get the same digital signature error as before and it did not copy the WsusScn2.cab file to the target computer. I navigated to the cache on the BP Host computer and found that the WsusScn2.cab file had renamed itself “WsusScn2.cab.PARTIAL” and was 0 KB. I deleted it and re-copied the WsusScn2.cab file to the Host. Then I was able to run “Retrieve consolidated url list of available updates” successfully. I ran it a second time to see if it still works with a WsusScn2.cab file already on the target computer. It does.

Then I tried running “Retrieve consolidated url list of available updates” on a different target computer without first removing the WsusScn2.cab file from it. It worked.

In summary… I have no idea how the “WsusScn2.cab.PARTIAL” file got on the BP Host, but that seems to have been the problem. Once I replaced it with the correct file that I downloaded directly from Microsoft, everything worked.

I still am unable to use BatchPatch on the internet connected computer to download the WsusScn2.cab file, but hopefully that is a transient issue as you suggested. It seems like everyone else using BatchPatch would also have a problem running “Download Microsoft offline scan file”, but maybe not.

I have a workaround. Thank you.

[doug]

Thanks for the detailed explanation. The .PARTIAL file is what BatchPatch places in the BatchPatch local update cache directory while it is downloading the WsusScn2.cab file from Microsoft. When the download completes, the .PARTIAL file is renamed properly to WsusScn2.cab. If the download does not complete or fails for whatever reason, the .PARTIAL file is deleted. It’s unclear exactly what happened in your case, but clearly something just didn’t work properly. Seems like maybe your internet-connected computer just has a poor internet connection? Maybe lots of packet loss or something that is causing the connection to be severed/terminated? I don’t know. Under normal circumstances any type of error/failure during download would result in the .PARTIAL file being deleted, but perhaps something in your case created some weird edge case where things didn’t function properly. It’s hard to say. And you are correct that we would definitely be hearing from other people and would be able to reproduce the issue here if there were a significant issue with the download code, but it’s the same download code that has been in the software for many years and used by tons of people without issues, so at the moment all signs point to something in your environment or internet connection being the culprit for what you’re experiencing. I’m glad you were able to get things working for now. If you make any major discoveries about what is going on, feel free to post back here to let us know. Thanks.

[eklieb]

I know this is an old post, but I had this issue and figured out that I needed SchUseStrongCrypto set to 1.

Set-ItemProperty -Path ‘HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319’ -Name ‘SchUseStrongCrypto’ -Value ‘1’ -Type DWord
Set-ItemProperty -Path ‘HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319’ -Name ‘SchUseStrongCrypto’ -Value ‘1’ -Type DWord

[Author]

Posts