Failed to download content id. Error: invalid certificate signature. Authentication of file failed, error 0x800b0004. DownloadUpdateContent failed with hr=0x80073633.

Stan Czerno 36

Microsoft Endpoint Configuration Manager version 2006

Windows Server 2012 R2

When trying to manually download any "Microsoft 365 Apps Update - Semi-Annual Enterprise Channel" to a deployment, the download fails.

Failed to download content id. Error: invalid certificate signature

I get the following in the PatchDownloader.log:

Connecting - Adding file range by calling HttpAddRequestHeaders, range string = "Range: bytes=0-" $$<Software Updates Patch Downloader><10-21-2020 15:38:41.359+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 27 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.643+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 55 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.644+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 82 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.645+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 100 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.645+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat to C:\Users\<me>\AppData\Local\Temp\CAB4512.tmp returns 0 $$<Software Updates Patch Downloader><10-21-2020 15:38:41.646+300><thread=14112 (0x3720)>
Using per-user settings for CRL checking. $$<Software Updates Patch Downloader><10-21-2020 15:38:41.647+300><thread=14112 (0x3720)>
Cert revocation check is disabled so cert revocation list will not be checked. $$<Software Updates Patch Downloader><10-21-2020 15:38:41.647+300><thread=14112 (0x3720)>
To enable cert revocation check use: UpdDwnldCfg.exe /checkrevocation $$<Software Updates Patch Downloader><10-21-2020 15:38:41.648+300><thread=14112 (0x3720)>
Verifying file trust C:\Users\<me>\AppData\Local\Temp\CAB4512.tmp $$<Software Updates Patch Downloader><10-21-2020 15:38:41.649+300><thread=14112 (0x3720)>
Authentication of file C:\Users\<me>\AppData\Local\Temp\CAB4512.tmp failed, error 0x800b0004 $$<Software Updates Patch Downloader><10-21-2020 15:38:41.657+300><thread=14112 (0x3720)>
ERROR: DownloadUpdateContent() failed with hr=0x80073633 $$<Software Updates Patch Downloader><10-21-2020 15:38:41.659+300><thread=1640 (0x668)>

If I uninstall KB4580358, I can download successfully.

Anyone else experiencing this?

THJeremy 1 Reputation point

2020-11-05T21:23:47.507+00:00

Does installing this fix anyone https://www.prajwaldesai.com/sccm-2006-hotfix-kb4578605-configmgr-2006-update/
occasionallydennis 36 Reputation points

2021-02-10T18:00:12.027+00:00

Is anyone else seeing regression of this error while running the latest CM 2010 build with KB4594177 installed?
JeremyR 16 Reputation points

2021-02-10T21:16:34.437+00:00

I'm running CM 2006 w/ KB4575787 installed and am unable to download "Microsoft 365 Apps Update - Current Channel Version 2101 for x86 based Edition (Build 13628.20380)".

We ran into this last November too & applied a hotfix for SCCM which resolved it at the time.

In %temp%\patchdownloader.log I have:
Verifying file trust C:\Users\<username>\AppData\Local\Temp\11\CAB894C.tmp.c2rx
Authentication of file C:\Users\<username>\AppData\Local\Temp\11\CAB894C.tmp.c2rx failed, error 0x800b0004
ERROR: DownloadUpdateContent() failed with hr=0x80073633
Jennings, Donna 6 Reputation points

2021-02-11T08:22:06.313+00:00

We are running 2006 with Hotfix Rollup KB4575789, we've just had an issue again downloading M365 (Office) too:

Downloading content for ContentID = 326004, FileName = office\data\16.0.12527.21594\stream.x64.gl-es.dat.cat.
Proxy is enabled for download, using registry settings or defaults.
FileHash value is NULL. Hash verification for this file will not be performed.
Connecting - Adding file range by calling HttpAddRequestHeaders, range string = "Range: bytes=0-"
HttpSendRequest failed 500
Download http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/office/data/16.0.12527.21594/stream.x64.gl-es.dat.cat to C:\Windows\TEMP\CAB6327.tmp.cat returns 500
ERROR: DownloadUpdateContent() failed with hr=0x800701f4
Jennings, Donna 6 Reputation points

2021-02-11T14:20:15.983+00:00

Reran the ADR today, its taken nearly six hours as its in the middle of our working day but the download has successfully completed (we have all languages ticked as we operate across the globe), so hopefully it was just a connection/availability issue.
Darrell Shand 11 Reputation points

2021-02-11T15:03:07.18+00:00

we are on 2006 with Hotfix Rollup KB4575789

Also getting issues with the O365 ADR original ADR started with error 0x80073633 Invalid Certificate Signature, when rerun it gives error 0x87D20417 Auto Deployment Rule download failed

I have recreated the ADR with same settings as original and again have the error 0x80073633 Invalid Certificate Signature
Alainneke 11 Reputation points

2021-02-11T15:26:57.627+00:00

Same here, running 2010 with KB4594177. All other ADRs work fine, only O365 gives "0x87d20417"
Jennings, Donna 6 Reputation points

2021-02-11T15:35:47.587+00:00

What OS updates do you have on your site servers? Have you installed the Feb updates? Ours have the Jan updates installed, not yet Feb they get installed tonight.
Alainneke 11 Reputation points

2021-02-11T15:54:14.257+00:00

We're running the January updates, the February ones are yet to be approved
Darrell Shand 11 Reputation points

2021-02-11T17:55:39.373+00:00

iours are still on Jan updates as as Maint window isnt until this weekend
Darrell Shand 11 Reputation points

2021-02-11T17:57:38.13+00:00

please let me know if you still have the same issues after your update
Randy_Nerbas 1 Reputation point

2021-02-11T18:05:14.567+00:00

We started having this issue in the fall. So a couple of weeks ago, we upgraded to 2010 and were able to download a January O365 update. Hooray!

Then comes yesterday and the issue reappeared for the Feb 9 Current Channel release of 2101.13628.20380. The same invalid cert error.

But ONLY for that release. I can download the immediately preceding one that is now superseded. Or the Semi-Annual Enterprise version. Or a Windows 7 version or any other version I try. The ONLY one I get the error on is the current one that I want and need.

Has anyone else seen that? Or am I an extra-special kind of ridiculous? The callous was just starting to soften on my forehead ...
Jason Sandys 31,161 Reputation points Microsoft Employee

2021-02-11T18:36:40.51+00:00

We are aware of the reported issues and believe we understand the root cause -- it's different and unrelated to the similar issue that occurred in the fall. How we address this is still TBD, but we are working on it.
Randy_Nerbas 1 Reputation point

2021-02-11T18:53:45.273+00:00

Hi Jason.

Is this specific to the Feb 9 Current Channel release of 2101.13628.20380? If so, I will cease and desist trying to resolve it on my own. As stated earlier, I am able to get any other update I choose, just not this one.

Thanks in advance.
Jason Sandys 31,161 Reputation points Microsoft Employee

2021-02-11T19:01:08.033+00:00

Correct. The issue, to our knowledge, is restricted to the latest Microsoft 365 update. The fix should be on our end as well, so we aren't at this time expecting any changes by customers other than to reinitiate the download. That's still a bit TBD though so yep, holding pattern for now.
Aswani Kumar G 1 Reputation point

2021-02-12T06:26:11.19+00:00

Hi,

thanks for the update.

Was October 2020 CU Un-installed prior to upgrading SCCM CB with Hotfix Rollup KB4575789?

is it mandatory to uninstall this October 2020 CU?
Aswani Kumar G 1 Reputation point

2021-02-12T06:44:42.063+00:00

thanks for sharing the update.

I think there no official update from MS regarding this issue or "mentioning to Uninstall October 2020 CU from the servers".
people are suffering because of their patches and production applications are getting impacted and they are sitting idle, leaving us to suffer.
Jennings, Donna 6 Reputation points

2021-02-12T07:54:50.187+00:00

Hi, ours was fine after rerunning the ADR (with the Jan server CU updates installed on the site server) however we are not downloading updates for the latest M365 apps (Office) build, we are downloading for v2002, Jason's comments suggest the issue is only related to the latest version of M365 Apps and that they are working on a fix. Ours therefore must've been a different issue as we also had a different error code.
Jennings, Donna 6 Reputation points

2021-02-12T08:01:39.137+00:00

Hi, no there was no need to uninstall the October CU in order to update ConfigMgr as the ConfigMgr hotfix rollup contained the fix that allows the downloads to work with the CU installed. Prior to updating to 2006 however yes we did temporarily remove the Oct CU from a jump box with the ConfigMgr console installed just to enable us to download the M365 apps updates for that month and then we reinstalled the CU and updated ConfigMgr to 2006 a couple of weeks later before the next Patch Tuesday release.

Jason's comments:

"The issue, to our knowledge, is restricted to the latest Microsoft 365 update. The fix should be on our end as well, so we aren't at this time expecting any changes by customers other than to reinitiate the download. That's still a bit TBD though so yep, holding pattern for now"
Harji, Menesh 11 Reputation points

2021-02-12T10:09:26.01+00:00

We are still on 1910 and we have the same issue with the o365 Feb Patches. Do we know when this will be fixed
Darrell Shand 11 Reputation points

2021-02-12T10:11:15.407+00:00

Ive logged a call with MS support this morning, as jason said just hold until its fixed as its at their end
Henrik Thilander 6 Reputation points

2021-02-12T10:58:56.57+00:00

We are running CB 2010 with latest hotfixes KB4594176/4594177 and having the exakt the same problem when downloading x64/x86 (Microsoft 365 Apps Update - Current Channel Version 2101 for x86 based Edition (Build 13628.20380) and Microsoft 365 Apps Update - Current Channel Version 2101 for x86 based Edition (Build 13628.20380)
Failed to download content id xxxxxxxxx . Error: Invalid certificate signature. ADR error 0x80073633.
Darrell Shand 11 Reputation points

2021-02-12T14:37:10.11+00:00

MS support have said the fault is with unsigned .c2rx files. so all up to them to fix and redeploy the signed files i'm guessing
Jason Sandys 31,161 Reputation points Microsoft Employee

2021-02-12T16:06:55.917+00:00

This is correct. Please see my comment above.
Jason Sandys 31,161 Reputation points Microsoft Employee

2021-02-12T16:09:30.127+00:00

Please read the entire thread (as mottled as it is). We know of the issue and are working on a fix. The expectation is that the fix will be on our end only (as it's related to the content of the latest M365 Apps update and not functionality of ConfigMgr). No one is leaving you to suffer although is you feel you are suffering, then you need to open a support case.
Jason Sandys 31,161 Reputation points Microsoft Employee

2021-02-12T16:16:04.06+00:00

Going to close this thread after I post this answer and reiterate the information. We believe we understand the exact issue occurring. This new issue is only loosely related to the issue originally reported in this thread. We don't expect customers to have to change anything on their end as the issue is related to the content in the update and not ConfigMgr itself. As we work on implementing and validating the fix, please stand-by. If you are concerned about this message or the impact of the issue, please open a support case.
Ivan Radunković (Span) 1 Reputation point

2021-02-15T09:43:00.267+00:00

Where is new thread regarding O365 Updates?
Harji, Menesh 11 Reputation points

2021-02-16T08:55:48.793+00:00

Do we know when this will be fixed by MS

Accepted answer

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-11-09T05:23:17.177+00:00

Note that 2006 hotfix rollup released last week addresses the download issue. If you aren't running 2006, I don't think you're going to see a fix.

See https://support.microsoft.com/en-us/help/4578605/update-rollup-for-microsoft-endpoint-configuration-manager-version-200
Please sign in to rate this answer.

2 people found this answer helpful.
Brian L99 1 Reputation point

2020-11-10T22:10:07.243+00:00

Jason,

Do you know if this would be the same issue for 2002 (Hotfix KB4553501). I have a CAS (don't ask why it's overkill, GEO/Political reasons) and something that worked last month does not today.

Worked in October: Microsoft 365 Apps Update - Semi-Annual Enterprise Channel Version 2002 for x86 based Edition (Build 12527.21236)
Failed in November: Microsoft 365 Apps Update - Semi-Annual Enterprise Channel Version 2002 for x86 based Edition (Build 12527.21330)

If this is the case I can use one of the workarounds listed. I just don't want to waste a couple days with a case or those workarounds and find out this issue is exclusive to 2006.

Thanks,
Brian

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-11-11T01:57:10.107+00:00

Correct. Only the 2006 hotfix rollup released late last week addresses this and I know of no plans at this time about fixing this for any down-level versions of ConfigMgr. Our standard practice is not to issue fixes for down-level versions and to my knowledge, we never have in the CB era of ConfigMgr.

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-11-11T16:53:03.48+00:00

Update: We are investigating the possibility of down-level CM updates for this. There would be a significant pain point for customers though so the investigation is on-going and no decision has been made. We strongly prefer orgs to upgrade to 2006 + HFRU to address this issue.

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-11-11T22:27:30.027+00:00

I've already posted an update (it's on the next page of the answers if you aren't seeing it).

As for maintaining your software, that's the nature of software and security. This isn't about us intentionally breaking customers, it's about us keeping our products secure and thus our customer's as well. Sometimes, this breaks things and there are ramifications for all involved. There was no incompetence or malice involved here.

Brian L99 1 Reputation point

2020-11-12T16:03:31.403+00:00

Thanks Jason, that is what I suspected & your update too.

Do you know if 2020-11 2012r2 KB4586786 fixes this problem?

When I tried to download from the catalog, it gave me a link for "noop_a1aed054581993fcfb1085f8d08dde385566efc0.exe"???

I pulled the 600+ individual files for both the x86 and x64 version overnight. When I point to "\MyShare\365Apps\November\x64\7ffbc6bf-bc32-4f92-8982-f9dd17fd3114" I still get "Error: Invalid certificate signature".

I don't want to have to back out the 2020-10 patch because we are looking to deploy 2006 (and the hotfix) late December. Don't want to have to install/uninstall/reboot production systems multiples times as a workaround.

Thanks for any insight.
Brian

Brian L99 1 Reputation point

2020-11-12T17:00:47.477+00:00

Jason - Thanks, I see your comments further down in the thread of this conversation. I will evaluate best "next steps" for our company. I suspect it will be moving forward with the 2002 hotfix and dealing with the pain it causes to 2006 at that time.
Sign in to comment

14 additional answers

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-10-23T18:40:01.553+00:00
There's a known issue due to some increased security around the download of the Office (aka Microsoft 365 apps) update files.

There are two current workarounds:

Uninstall the October patches from the primary site server and reboot.

Manually download the updates (using the download link from PatchDownloader.log or the Content Location tab of the update's properties) to an accessible UNC and use a that UNC for the download location in ConfigMgr.
Please sign in to rate this answer.

4 people found this answer helpful.
Mikael Zewgren 36 Reputation points

2020-10-26T07:16:17.34+00:00

Hi,

All the main update files are downloded for me (.cab and .dat) but the .cat files fail. The PatchDownloader.log only tries the first .cat file UNC and then the download process stops. How do I get the other download links, as I assume there are more than one .cat file?

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-10-26T14:25:29.807+00:00

Have you reviewed the Content Location tab of the update(s) as noted?

Mikael Zewgren 36 Reputation points

2020-10-27T07:12:27.413+00:00

Hi,

Our clients get updates directly via CDN so we have no SU setup in Config Manager. This error occurs when I try to create a new Office 365 application, but the cause of the errors seem to be the same as it worked before the October patch.

TBA 1 Reputation point

2020-11-11T23:53:55.757+00:00

To do the manual download, which links do you use, their are loads of them under the content location tab, and patchdownloader has lots too.

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-11-12T02:42:41.14+00:00

All of them. They are listed there because they are required.

Jennings, Donna 6 Reputation points

2020-11-12T10:29:03.437+00:00

I've used a script (written by my husband) to do this as there is 629 files in total for the update we require. If you go into the properties of the required update in the ConfigMgr console and then click on Content information, copy the list of source paths into a text document and save.

Try the below, make sure you change the paths to the locations you want to read your text file from and save files too.

$list = Get-Content -Path "\\ServerName\ShareName\FolderName\365Updates.txt" #contains list of url’s foreach ($name in $list) { $filename = $null #make sure var is emtpy $filename = [System.IO.Path]::GetFileName($name) $filename Invoke-WebRequest -Uri $name -OutFile "\\ServerName\ShareName\FolderName\$filename" }

Brian L99 1 Reputation point

2020-11-12T16:12:35.86+00:00

I also used PowerShell to download all the files in the "Content Information" tab. But after pulling them down and putting them on a share I am still getting "Error: Invalid certificate signature".

My share is similar to "\MyShare\365Apps\November\x64\7ffbc6bf-bc32-4f92-8982-f9dd17fd3114" with the "Office\Data" structure under there.

I've never had to do this before and having issues. Were you able to use the files you downloaded to get the content into a SU package?

Jennings, Donna 6 Reputation points

2020-11-13T12:12:30.18+00:00

Hi, yeah was still getting the error after manually downloading the files. I removed the October and November CU from our jump box that has the ConfigMgr console installed and they appear to be validating ok now (still in progress).

Brian Kaler 1 Reputation point

2020-12-10T00:04:34.043+00:00

I think I have all the files for our update (taken from the patchdownloader.log) but no matter if I use the wizard or the powershell, I get the same error below that it cannot find the path. The path checks out, and I've checked permissions, used local paths, remote paths. Nothing works.

Save-CMSoftwareUpdate : The system cannot find the path specified

Jason Sandys 31,161 Reputation points Microsoft Employee

2020-12-10T14:45:31.72+00:00

Is there a reason you aren't applying the appropriate hotfix or upgrading to 2006 or 2010?

Smith, Bob 1 Reputation point

2021-01-26T18:07:52.993+00:00

Jason - I've tried your workaround #2 and does not appear to work and generates the same error. Have you tried it yourself?

Jason Sandys 31,161 Reputation points Microsoft Employee

2021-01-26T19:03:27.36+00:00

Same question as above: Is there a reason you aren't applying the appropriate hotfix or upgrading to 2006 or 2010?

Smith, Bob 1 Reputation point

2021-01-26T19:08:53.807+00:00

Yes, because I'm not the administrator and I'm not allowed to do the system upgrade. The appropriate people in my company have been notified and are preparing to do it. I was using your workaround until the system gets upgraded.

Now how about my question above: Have you tried the workaround yourself?

Jennings, Donna 6 Reputation points

2021-01-27T08:26:39.213+00:00

We also at the time used workaround #2 as were not allowed to upgrade ConfigMgr immediately (that was completed a couple of weeks afterwards). However to get workaround #2 to work we had to use a server (jump box in our case) with the configmgr console installed, we had to temporarily remove both the October and November patches from the server (if you still haven't resolved you are likely to need to remove the December and January updates from your device too as they are cumulative so will include Octobers updates) then download the files using a script and then update the content etc with those downloaded files. Then we reinstalled the updates on the server.

I did the above as per comments from BrianL99-3377 on Nov 12 and 18th.

I also posted the script used in comments above on 12th Nov.
Sign in to comment

AndAuf 16

Same problem here

Download http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/office/data/16.0.13328.20292/i640.cab.cat to C:\Windows\TEMP\CABDFFF.tmp returns 0 Software Updates Patch Downloader 02.11.2020 11:05:44 2960 (0x0B90)
Using machine settings for CRL checking. Software Updates Patch Downloader 02.11.2020 11:05:44 2960 (0x0B90)
Cert revocation check is disabled so cert revocation list will not be checked. Software Updates Patch Downloader 02.11.2020 11:05:44 2960 (0x0B90)
To enable cert revocation check use: UpdDwnldCfg.exe /checkrevocation Software Updates Patch Downloader 02.11.2020 11:05:44 2960 (0x0B90)
Verifying file trust C:\Windows\TEMP\CABDFFF.tmp Software Updates Patch Downloader 02.11.2020 11:05:44 2960 (0x0B90)
Authentication of file C:\Windows\TEMP\CABDFFF.tmp failed, error 0x800b0004 Software Updates Patch Downloader 02.11.2020 11:05:44 2960 (0x0B90)
ERROR: DownloadUpdateContent() failed with hr=0x80073633 Software Updates Patch Downloader 02.11.2020 11:05:44 26316 (0x66CC)

Krystian Kruszynski 6 Reputation points

2020-11-03T11:08:05.5+00:00

The problem is the last updates from oktober.
Remove one of the following updates:
KB4580347
KB4580358
KB4578989
KB4578981

And your ADR office 365 will work again
Please sign in to rate this answer.

1 person found this answer helpful.
Mikael Zewgren 36 Reputation points

2020-11-03T11:52:48.58+00:00

This has already been suggested earlier in this thread. However it is a short term solution and not acceptable for the long run.
Sign in to comment
Stan Czerno 36 Reputation points

2020-11-09T14:43:12.347+00:00

I can confirm the 2006 Hotfix KB4578605 corrected the issue.
Please sign in to rate this answer.

1 person found this answer helpful.
Mikael Zewgren 1 Reputation point

2020-11-15T10:47:47.51+00:00

Same here!

D╗ng 1 Reputation point

2020-11-18T09:47:44.803+00:00

KB4578605 fixed for us too!
Sign in to comment