wsusscn2.cab signature verification failure

[TonyTonsils]

After a fresh install of Windows 7, I've been trying to use this program to install my updates. However, this error keeps cropping up at every attempt.

Code: Select all

Tue 10/25/2016 23:46:01.08 - Info: Starting WSUS Offline Update download (v. 10.8) for w61-x64 glb
Tue 10/25/2016 23:46:01.08 - Info: Option /includedotnet detected
Tue 10/25/2016 23:46:01.10 - Info: Option /verify detected
Tue 10/25/2016 23:46:01.12 - Info: Option /exitonerror detected
Tue 10/25/2016 23:46:01.21 - Info: Set time zone to LOC4:00
2016-10-25 23:46:01 URL:http://download.wsusoffline.net/StaticDownloadFiles-modified.txt [341/341] -> "../static/StaticDownloadFiles-modified.txt" [1]
2016-10-25 23:46:03 URL:http://download.wsusoffline.net/StaticUpdateFiles-modified.txt [63/63] -> "../client/static/StaticUpdateFiles-modified.txt" [1]
Tue 10/25/2016 23:46:03.94 - Info: Updated static download and update definitions
Tue 10/25/2016 23:46:06.62 - Info: Downloaded/validated mkisofs tool
Tue 10/25/2016 23:46:07.11 - Info: Downloaded Sysinternals' tools Autologon, Sigcheck and Streams
Tue 10/25/2016 23:46:53.92 - Info: Downloaded/validated most recent Windows Update catalog file
Tue 10/25/2016 23:46:53.92 - Warning: Deleted unsigned file "C:\Users\Tonsils\Desktop\wsusoffline\client\wsus\wsusscn2.cab"
Tue 10/25/2016 23:46:54.37 - Error: Catalog file ..\client\wsus\wsusscn2.cab signature verification failure


I hear the normal solution is to go to .\client\md and clear it out, but the problem is that my version does not have an md folder. Is there any way to save this?

[matteg]

I have been trying to download the offline WSUS without success.
When running the update generator downloads appear to happen without any problems.
Then there is a warning followed by an error when trying to verify the signature of wsusscn2.cab:
The log indicates:
Tue 10/25/2016 21:24:06.83 - Info: Starting WSUS Offline Update download (v. 10.8) for w61-x64 glb
Tue 10/25/2016 21:24:06.83 - Info: Option /includedotnet detected
Tue 10/25/2016 21:24:06.85 - Info: Option /includewddefs detected
Tue 10/25/2016 21:24:07.05 - Info: Option /verify detected
Tue 10/25/2016 21:24:07.06 - Info: Option /exitonerror detected
Tue 10/25/2016 21:24:07.22 - Info: Set time zone to LOC7:00
2016-10-25 21:24:07 URL:http://download.wsusoffline.net/StaticDownloadFiles-modified.txt [341/341] -> "../static/StaticDownloadFiles-modified.txt" [1]
2016-10-25 21:24:09 URL:http://download.wsusoffline.net/StaticUpdateFiles-modified.txt [63/63] -> "../client/static/StaticUpdateFiles-modified.txt" [1]
Tue 10/25/2016 21:24:09.83 - Info: Updated static download and update definitions
Tue 10/25/2016 21:24:13.41 - Info: Downloaded/validated mkisofs tool
Tue 10/25/2016 21:24:13.87 - Info: Downloaded Sysinternals' tools Autologon, Sigcheck and Streams
Tue 10/25/2016 21:24:58.33 - Info: Downloaded/validated most recent Windows Update catalog file
Tue 10/25/2016 21:24:58.34 - Warning: Deleted unsigned file "C:\Users\Gerry\Downloads\wsusoffline108\wsusoffline\client\wsus\wsusscn2.cab"
Tue 10/25/2016 21:25:05.42 - Error: Catalog file ..\client\wsus\wsusscn2.cab signature verification failure

[Denniss]

Microsoft probably released an updated file but not all servers are in sync or supplying a broken file.
Please retry after some hours or on the next day.

[matteg]

Tried again 24 hours later.
Same error attempting to verify the catalog file signature.
Will try again tomorrow.

After the above post was made I continued to look for possible causes. I came across a change made in March 2007 by Microsoft that could have been a cause if it happened recently. See https://support.microsoft.com/en-ca/kb/926464

Since I am certain your new versions are fully tested before release, it seems possible that Microsoft may have made a change which caused the tested version to now malfunction.

If so, others should be able to replicate the error I see by downloading the offline update tool (version 10.8) to my downloads folder, expanding the zip file, and running UpdateGenerator.exe. The only option I checked was to download x64 Global (multilingual updates).

The last three lines of the log identify the error I encounter:
Tue 10/25/2016 21:24:58.33 - Info: Downloaded/validated most recent Windows Update catalog file
Tue 10/25/2016 21:24:58.34 - Warning: Deleted unsigned file "C:\Users\Gerry\Downloads\wsusoffline108\wsusoffline\client\wsus\wsusscn2.cab"
Tue 10/25/2016 21:25:05.42 - Error: Catalog file ..\client\wsus\wsusscn2.cab signature verification failure

I ask that a few others test run this version to ensure that the problem is not some unique problem in my environment.
Thanks.

[jgh]

I too am getting

"ERROR: Catalog file ..\client\wsus\wsusscn2.cab signature verification failure."

I only selected Windows Server 2008 x64 updates

[aker]

Could you manually download http://download.windowsupdate.com/microsoftupdate/v6/wsusscan/wsusscn2.cab ?
Then right click it, select properties, choose digital signature and check, if both signatures are valid.

Also please try installing http://download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/rootsupd.exe (with administrative rights) and recheck the signature.

[matteg]

I downloaded wsusscn2.cab using the url provided.
On windows 7 pro right-click+properties does not display an option to verify signatures.
Running rootsupd.exe produced no visible effect whether run from a windows explorer file manager or as a dos command.
(both run as Administrator)

aker, user jgh replicated the error on his/her machine.
Are you unable to replicate the problem on your machine ?

[matteg]

After a few hours, it occurred to me to re-try the original procedure of downloading the offline update and generating the updates for my system.
This time it worked - without a complaint that the signature for wsusscn2.cab was invalid.

I believe that Microsoft fixed the signature while we have been conversing about this problem.

However, it is also possible that when I executed rootsupd.exe as suggested by aker a change may have been made which fixed the signature verification error.

If jgh repeats their test and succeeds then Microsoft fixed the problem

If it fails again for jgh then my running rootsupd.exe fixed the problem and he/she should also run rootsupd.exe and retest

In any case, after completing the offline updates and rebooting, my PC is now correctly retrieving and installing updates using the windows update client.

Thanks to those who assisted in this happy outcome.

[boco]

That one?

[matteg]

wsusscn2-properties-digitalSignatureDetails-20161027.png

(41.71 KiB) Not downloaded yet

Great.
Mystery solved - sometime on Oct 27 Microsoft started publishing a wsusscn2.cab file that was signed.
The version that was being published previously was unsigned and that is why the digital signature verification was failing for TonyTonsils, me, and for jgh. See the attached screen image wsusscn2-properties.png attached to my post of Oct 27.

The wsusscn2.cab that was downloaded last evening contains the Digital Signatures tab that you were asking me to use. Screen image attached for this new file.

I'm guessing you did not examine the wsusscn2.cab properties at the time you initially responded ...... or you would have seen the same results as I and jgh - no embedded signature. I still have that version of the file if you wanted to check it out.

For me, I'm happy that the problem is resolved.