Overview

When LanGuard 2014 Agents performs Program Updates and attempt to download the wsusscn2.cab file, the following issue occurs:

• The lanss_112_configtools.csv logging shows Invalid digital signature.
• The downloaded wsusscn2.cab file size is 61 MB only.

Replication of the Issue:

1. Complains of any of the symptoms of Agent Update failures:
   • Cannot contact server in agent status pane
   • Patch management database unavailable in the scan results
   • Patch management database not up-to-date in the scan results
     
2. Check some of the agents' lanss_v112_configtools.csv for recent logging showing the following:
   NOTE: Debug does not have to be enabled. The configtools.csv log logs data with debugging off.
   "info ","update.exe","DownloadPackageFile - Preparing to download 'wsusscn2.cab' from 'http://go.microsoft.com/fwlink/?LinkID=74689'." "info ","update.exe","DownloadPackageFile - A valid handle obtainded to URL. Starting to download to 'C:\ProgramData\GFI\LanGuard 11\Update\wsusscn2.cab'." "info ","update.exe","ValidatePackageFile - Validating transfered content by checking the digital signature for 'C:\ProgramData\GFI\LanGuard 11\Update\wsusscn2.cab'." "error ","update.exe","DownloadPackageFile - Invalid digital signature."
   IMPORTANT: There is some indication that this only happens with agents that are across WAN links. Perform both from the LAN as the LanGuard server is on and also from agents across WAN links. The results should be submitted to the Support team for investigation.
   
3. Confirm the file size:
   1. Log onto an agent. 
   2. Open Internet Explorer (IE) and enter the URL using this format:
      http://LANGUARD_IP:PORT/files/update/wsusscn2.cab
   3. Download the wsusscn2.cab file to the desktop.
   4. Once done, right-click on the file and go Properties to view the file size.
      If the file size is about 61 MB instead of 79 MB the problem is confirmed.
      NOTE: IE file download status reports 79 MB even when the actual size of the file is 61 MB.

NOTE: When using Relays the error message Invalid digital signature is not visible on agents assigned to relays. Instead, it appears in the configtools.csv of the Relay Agent machine itself.

Environment

LanGuard 2014 (all builds)

Resolution

Download and install the patch included in the GFI LanGuard 2015 release via Program Updates.

NOTE: Upgrade GFI LanGuard when necessary.