Third-Party Updates Fail to Install with Error 0x800b0109 in SCCM

Justin Chalfant (Patch My PC) · February 23, 2019, 06:12:06 PM

Third-Party Updates Fail to Install with Error 0x800b0109 in SCCM

When attempting to install third-party software updates, you receive error code 0x800b0109.

Error-0x800b0109-Third-Party-Updates-SCCM

In WUAHandler.log, you will also see the following error in the log.

Failed to download updates to the WUAgent datastore. Error = 0x800b0109

Why does Error 0x800b0109 Happen?

Error code 0x800b0109 translates to:

A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

This error occurs when a client is attempting to install third-party software update(s) that are signed using a WSUS signing certificate that isn't trusted on the client devices.

Resolution to Error 0x800b0109

To resolve error code 0x800b0109, you need to distribute the WSUS signing certificate to the Trusted Root and Trusted Publishers certificate stores on your client devices.

You can distribute the certificate using the third-party software updates feature in SCCM 1806+ (Microsoft Docs), or you can deploy the certificate using group policy (PDF Guide).

We also have a detailed step-by-step video guide below that covers deploying the WSUS signing certificate using SCCM 1806+ or using group policy to resolve error 0x800b0109 on your clients.

Junge · January 27, 2020, 07:06:14 AM

We have the GPO solution and no https to the SUP. We are using a selfsigned cert right now but that will change soon.
Everything is running fine and the software is installing as we hoped.

The issue here is that we cannot rebuild (OSD) a machine without getting the 0x800b0109 error as its not trusted during the OSD fase. We have several steps "Check for Updates" and it does its job and finds the 3rd party patches but cannot install them and fails.

How would be the clever way to inject the cert during OSD?
Should we modify our TS to inject the cert or is there another way instead?

Justin Chalfant (Patch My PC) · January 27, 2020, 07:10:19 AM

Please try option 3 here: https://patchmypc.com/how-to-deploy-the-wsus-signing-certificate-for-third-party-software-updates

GPO's don't run during a task sequence.

Quote from: Junge on January 27, 2020, 07:06:14 AM

We have the GPO solution and no https to the SUP. We are using a selfsigned cert right now but that will change soon.
Everything is running fine and the software is installing as we hoped.

The issue here is that we cannot rebuild (OSD) a machine without getting the 0x800b0109 error as its not trusted during the OSD fase. We have several steps "Check for Updates" and it does its job and finds the 3rd party patches but cannot install them and fails.

How would be the clever way to inject the cert during OSD?
Should we modify our TS to inject the cert or is there another way instead?

duane.mccullough · March 24, 2020, 04:32:14 PM

Hi Justin,

Let me first start off by saying, I've watched all your setup videos on SCCM and I'm a huge fan and love your work!!
With your help, I was able to understand SCCM and roll out multiple computers and also do inplace upgrades as well. I wanted to say thank you for everything!

I'm wondering if you can help me or point me to a location

I am running version 1910 and am running into a problem with error 0x800b0109 as well. My issue is not Third-Party Updates. I created two ADR's for patch Tuesday (following your steps on the video "How to Deploy Software Updates Using Microsoft SCCM") . I can see updates downloaded and the package was created and distributed to both of my distribution points. When i go to deploy the updates to my pilot group (IT Department) the updates never deploy to the computers. I've tried removing my computer out from the device collection and read adding them or even deploy to other collections and they still never deploy. I did very that under "Software Update point Components Properties" under Third-Party Updates, the Cert is listed there and I also verified that the cert does populate on all my computers in "Trusted Publishers and "Trusted Root Certification Authorities"

I've attached logs. Please let me know if you can please assist or at least point me to the correct location.

Thank you again

Justin Chalfant (Patch My PC) · March 24, 2020, 04:44:01 PM

Does the client trust the SSL certificate on the WSUS server and is it still valid? Try browsing out to the WSUS URL in IE to see if there are certificate errors.

duane.mccullough · March 24, 2020, 05:02:37 PM

Yes i do. See attached. What does that mean?

Justin Chalfant (Patch My PC) · March 24, 2020, 05:03:18 PM

The client doesn't trust the issuing CA for the WSUS SSL cert.

duane.mccullough · March 24, 2020, 07:10:27 PM

That was it!! All working now. Thank you soo much for you help!!!!

allnewsm7 · July 19, 2020, 11:40:29 AM

This error occurs when a client is attempting to install third-party software update(s) that are signed using a WSUS signing certificate that isn't trusted or the allow third-party updates policy isn't enabled the machine. The signing certificate needs to be in the Trusted Root and Trusted Publishers certificate store.

adm25881 · September 25, 2024, 02:56:15 PM

Hello Justin, I have been reading this thread even though it is quite old! We have some machines failing with the same cert error. We have one primary, two secondaries. One of the secondaries seem to have issues. When i am on the machine i can reach one wsus server with no issues, the other shows Forbidden, access is denied. can you give me some idea where to begin.

declan2000 · November 05, 2024, 03:39:24 AM

As a college student, StudyProfy has been a lifesaver for me when it comes to writing essays. Their "write essay for me" service is so efficient and reliable! The essays are always high-quality, original, and exactly what I need to meet my academic goals. It's a fantastic resource for any student who needs some extra support, and I'd definitely recommend StudyProfy to anyone looking to improve their grades and manage their workload better!