agent's certificate for update server expired mid-sync and sync failed

TL;DR

An expired server certificate is unambiguous once you look at it, and strangely invisible until you do: the sync error usually surfaces as a generic TLS or connection failure. Check the certificate dates on the update endpoint directly, renew or replace the certificate through the server owner process (internal CA or public CA), bind the new certificate to the service (the WSUS IIS site binding and the wsusutil configuressl step where applicable), and restart the affected services.

agent's certificate for update server expired mid-sync and sync failed

Use this when

• Sync or client detection fails with certificate expired or a TLS handshake error starting on a specific date.
• Browsing to the WSUS or repository URL shows a certificate warning.
• The certificate was issued a year or more ago and never entered a renewal tracker.

Not for this skill when

• One client machine clock is wrong, making it reject valid certificates. Fix that client clock; the server certificate is fine.
• The certificate is valid but for a different name (the sync uses an IP or an old hostname). That is a name mismatch, fixed by names and bindings, not renewal.

Steps

1. Inspect the certificate presented by the update endpoint (browser padlock on the exact URL, or an openssl s_client check) and record its expiry date and issuer. Verify: expiry is confirmed as past, with the date captured
2. Check the agent and client clocks at the same time to rule out a time problem on the checking side. Verify: clocks are within a minute of true time
3. Have the server owner renew the certificate through the normal CA process and install it on the server. Verify: the new certificate is in the server store with the correct subject and SAN entries for the sync URL
4. Bind the new certificate to the service: update the IIS site binding for WSUS and run the WSUS SSL configuration step if WSUS is SSL-enabled, then restart the site and service. Verify: the endpoint now serves the new certificate
5. Run a sync and a client detection test, then add the certificate expiry to the monitoring or renewal tracker with an alert well before the new date. Verify: sync succeeds and a future expiry alert exists

Variant phrasings

wsus certificate expired sync fails renew bind iis

The main phrasing.

update server tls certificate expired mid cycle fix

The general phrasing.

wsusutil configuressl new certificate binding

The WSUS-specific step phrasing.

Compatibility: Compatibility: WSUS with SSL, ConfigMgr SUP, and internal HTTPS repositories; IIS binding steps apply to Windows-hosted services.

Why it happens

Certificate expiry is the most predictable failure in all of infrastructure: the date is printed on the certificate from the day it is issued. It still causes outages because the expiry lives outside the patch team usual dashboards, the error surfaces in a different team system as a vague TLS failure, and the binding step (especially WSUS, which needs its SSL configuration re-run) is easy to miss after renewal, leaving a new certificate installed but not served.

Edge cases / pitfalls

• Internal CA certificates often have shorter lifetimes than teams assume after a policy change; verify the actual new expiry instead of assuming a year.
• Renewal automation (ACME or the CA auto-enrollment) beats calendar reminders wherever the platform supports it.
• After fixing, scan the estate for the same certificate on other services; one expiry usually has siblings.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TtH09q42ojSDJfdZExa3uw