A couple of weeks ago, our OSD TS started failing. In the logs, I found a few updates were failing to install. All of the problem updates were for 3rd party software, published through SCUP. When I tried republishing updates from SCUP, I found that the signing certificate had expired. (I wouldn't expect that to have caused already published updates to fail to be deployed, especially since I do have the time-stamp option enabled in SCUP, but I can't find any other reason that these particular updates would be failing to deploy.)
I removed the affected updates from update groups so that they wouldn't be deployed anymore, and now the TS is completing successfully. I've requested a new cert from our CA and installed it in SCUP. I added the new cert to trusted publishers via group policy. I added a handful of new updates to an publication in SCUP and tried to re-publish it. The publish fails early on, with a failure to verify the signature on a package. Looking at the logs, it appears that the package in question is an update that was published previously. Since the package is the same and only metadata has changed, SCUP doesn't push the package again, but tries to update the metadata only. I am guessing that the signature verification fails because the package was signed with the old certificate, which was valid at the time, but has since expired. Does that make sense? At this point, I removed all old updates from the publication in SCUP and published it successfully with only the new updates. I believe I need to somehow get the old updates re-published though, so that they will have the updated metadata and the correct signature on the package, and can be added back into update groups for deployment. How can I get these previously published updates to republish to SCCM? Thanks, Steve Whitcher
