The following steps will guide you through the process. 

Requirements

• You have installed the Windows Server Update Services (WSUS) role on a Windows Server machine
• You have completed the initial server configuration for products and classifications. 
• Your Windows account is added to the WSUS-local security group "WSUS Administrators". 

NOTE: This article provides examples for Windows Server 2012 R2 WSUS installation, but you can likely apply the same or similar steps to later versions of Windows Server Update Services. 

Configure SSL in Microsoft Internet Information Services 8.5

1) Open Server Manager, navigate to Tools > Internet Information Services (IIS) Manager.


2) Click the server node in the tree. Double-click on "Server Certificates".


3) Here you have two options.

1. Use your own CA SSL certificate (highly suggested):
   1. Choose "Import",
   2. Proceed with step 4a.
2. Create a self-signed SSL certificate
   1.  Choose "Create Self-Signed Certificate.":
   2. Go with step 4b.

4a) Select your CA SSL certificate [PFX format], provide the password, and choose "Web hosting". 



4b) Provide a friendly name for the certificate. Choose. "Web Hosting" store and close it with OK.


5) Choose "WSUS Administration" in the left-hand-side tree list.


6) Choose "Bindings" in the Actions column.

7) Click on "https 8531" and choose "Edit"

8) Select the SSL certificate in the drop-down box and click "View...".



9) Make a note of the FQDN of the "Issued to" server and click OK.


10) Provide the FQDN hostname from the previous step and click OK.


11) Click Close.


12) Click on WSUS Administration Console, select SSL Settings, then enable 'Require SSL'  next. 



12) Expand "WSUS Administration". Choose "ClientWebService". Double-click "SSL Settings".


13) Mark the checkbox "Require SSL". Click Apply.
14) Repeat steps 12 and 13 for "DssAuthWebService",  "ServerSyncWebService", and "SimpleAuthWebService". Close the "Internet Information Services (IIS) Manager".

Validate changes with WsusUtil.exe

15) Run Command Prompt as Administrator.

16) Change to directory C:\Program Files\Update Services\Tools.

17) Run "WsusUtil.exe configuressl <FQDN>". The output should be similar to what is shown below. 

Export and Distribute SSL Certificate

 Next, export this certificate and provide it to all systems connecting to WSUS.

18) Run MMC as admin. Click File and choose "Add/Remove Snap-in"


19) Click Certificates and then click Add.


20) Enable "Computer account" and click Next.


21) Choose "Local computer" and click Finish. Click OK after that. 


22) Expand the Certificates (Local Computer) \ Trusted Root Certification Authorities.

23) Click on Certificates. Locate the certificate that matches the FQDN of this server.

24) Right-click and choose "All Tasks" and "Export"

Now that you have exported the certificate, provide it to all systems that need to connect to the WSUS server (SCCM, WU agents, SCCM clients). 

Import this certificate into the "Trusted Root Certification Authorities" (you can also do this by creating a GPO). Configure WSUS to use SSL, and integrate the Software Vulnerability Manager interface with the WSUS server using SSL.

Connect SVM to WSUS via SSL

25) In the Patching menu, navigate to Patching, choose Configuration -> WSUS/System Center.

26) Provide the FQDN as the WSUS server name (as in step 9).

27) Enter the correct WSUS SSL port, enable the "Use SSL Connection" checkbox, then press Connect.

28) Verify the connection in the connection status.