Failed to download content id. Error: invalid certificate signature. Authentication of file failed, error 0x800b0004. DownloadUpdateContent failed with hr=0x80073633.

Stan Czerno 36

Microsoft Endpoint Configuration Manager version 2006

Windows Server 2012 R2

When trying to manually download any "Microsoft 365 Apps Update - Semi-Annual Enterprise Channel" to a deployment, the download fails.

Failed to download content id. Error: invalid certificate signature

I get the following in the PatchDownloader.log:

Connecting - Adding file range by calling HttpAddRequestHeaders, range string = "Range: bytes=0-" $$<Software Updates Patch Downloader><10-21-2020 15:38:41.359+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 27 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.643+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 55 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.644+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 82 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.645+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat in progress: 100 percent complete $$<Software Updates Patch Downloader><10-21-2020 15:38:41.645+300><thread=14112 (0x3720)>
Download http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf/office/data/16.0.13127.20638/i640.cab.cat to C:\Users\<me>\AppData\Local\Temp\CAB4512.tmp returns 0 $$<Software Updates Patch Downloader><10-21-2020 15:38:41.646+300><thread=14112 (0x3720)>
Using per-user settings for CRL checking. $$<Software Updates Patch Downloader><10-21-2020 15:38:41.647+300><thread=14112 (0x3720)>
Cert revocation check is disabled so cert revocation list will not be checked. $$<Software Updates Patch Downloader><10-21-2020 15:38:41.647+300><thread=14112 (0x3720)>
To enable cert revocation check use: UpdDwnldCfg.exe /checkrevocation $$<Software Updates Patch Downloader><10-21-2020 15:38:41.648+300><thread=14112 (0x3720)>
Verifying file trust C:\Users\<me>\AppData\Local\Temp\CAB4512.tmp $$<Software Updates Patch Downloader><10-21-2020 15:38:41.649+300><thread=14112 (0x3720)>
Authentication of file C:\Users\<me>\AppData\Local\Temp\CAB4512.tmp failed, error 0x800b0004 $$<Software Updates Patch Downloader><10-21-2020 15:38:41.657+300><thread=14112 (0x3720)>
ERROR: DownloadUpdateContent() failed with hr=0x80073633 $$<Software Updates Patch Downloader><10-21-2020 15:38:41.659+300><thread=1640 (0x668)>

If I uninstall KB4580358, I can download successfully.

Anyone else experiencing this?

THJeremy 1 Reputation point

2020-11-05T21:23:47.507+00:00

Does installing this fix anyone https://www.prajwaldesai.com/sccm-2006-hotfix-kb4578605-configmgr-2006-update/
occasionallydennis 36 Reputation points

2021-02-10T18:00:12.027+00:00

Is anyone else seeing regression of this error while running the latest CM 2010 build with KB4594177 installed?
JeremyR 16 Reputation points

2021-02-10T21:16:34.437+00:00

I'm running CM 2006 w/ KB4575787 installed and am unable to download "Microsoft 365 Apps Update - Current Channel Version 2101 for x86 based Edition (Build 13628.20380)".

We ran into this last November too & applied a hotfix for SCCM which resolved it at the time.

In %temp%\patchdownloader.log I have:
Verifying file trust C:\Users\<username>\AppData\Local\Temp\11\CAB894C.tmp.c2rx
Authentication of file C:\Users\<username>\AppData\Local\Temp\11\CAB894C.tmp.c2rx failed, error 0x800b0004
ERROR: DownloadUpdateContent() failed with hr=0x80073633
Jennings, Donna 6 Reputation points

2021-02-11T08:22:06.313+00:00

We are running 2006 with Hotfix Rollup KB4575789, we've just had an issue again downloading M365 (Office) too:

Downloading content for ContentID = 326004, FileName = office\data\16.0.12527.21594\stream.x64.gl-es.dat.cat.
Proxy is enabled for download, using registry settings or defaults.
FileHash value is NULL. Hash verification for this file will not be performed.
Connecting - Adding file range by calling HttpAddRequestHeaders, range string = "Range: bytes=0-"
HttpSendRequest failed 500
Download http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114/office/data/16.0.12527.21594/stream.x64.gl-es.dat.cat to C:\Windows\TEMP\CAB6327.tmp.cat returns 500
ERROR: DownloadUpdateContent() failed with hr=0x800701f4
Jennings, Donna 6 Reputation points

2021-02-11T14:20:15.983+00:00

Reran the ADR today, its taken nearly six hours as its in the middle of our working day but the download has successfully completed (we have all languages ticked as we operate across the globe), so hopefully it was just a connection/availability issue.
Darrell Shand 11 Reputation points

2021-02-11T15:03:07.18+00:00

we are on 2006 with Hotfix Rollup KB4575789

Also getting issues with the O365 ADR original ADR started with error 0x80073633 Invalid Certificate Signature, when rerun it gives error 0x87D20417 Auto Deployment Rule download failed

I have recreated the ADR with same settings as original and again have the error 0x80073633 Invalid Certificate Signature
Alainneke 11 Reputation points

2021-02-11T15:26:57.627+00:00

Same here, running 2010 with KB4594177. All other ADRs work fine, only O365 gives "0x87d20417"
Jennings, Donna 6 Reputation points

2021-02-11T15:35:47.587+00:00

What OS updates do you have on your site servers? Have you installed the Feb updates? Ours have the Jan updates installed, not yet Feb they get installed tonight.
Alainneke 11 Reputation points

2021-02-11T15:54:14.257+00:00

We're running the January updates, the February ones are yet to be approved
Darrell Shand 11 Reputation points

2021-02-11T17:55:39.373+00:00

iours are still on Jan updates as as Maint window isnt until this weekend
Darrell Shand 11 Reputation points

2021-02-11T17:57:38.13+00:00

please let me know if you still have the same issues after your update
Randy_Nerbas 1 Reputation point

2021-02-11T18:05:14.567+00:00

We started having this issue in the fall. So a couple of weeks ago, we upgraded to 2010 and were able to download a January O365 update. Hooray!

Then comes yesterday and the issue reappeared for the Feb 9 Current Channel release of 2101.13628.20380. The same invalid cert error.

But ONLY for that release. I can download the immediately preceding one that is now superseded. Or the Semi-Annual Enterprise version. Or a Windows 7 version or any other version I try. The ONLY one I get the error on is the current one that I want and need.

Has anyone else seen that? Or am I an extra-special kind of ridiculous? The callous was just starting to soften on my forehead ...
Jason Sandys 31,176 Reputation points Microsoft Employee

2021-02-11T18:36:40.51+00:00

We are aware of the reported issues and believe we understand the root cause -- it's different and unrelated to the similar issue that occurred in the fall. How we address this is still TBD, but we are working on it.
Randy_Nerbas 1 Reputation point

2021-02-11T18:53:45.273+00:00

Hi Jason.

Is this specific to the Feb 9 Current Channel release of 2101.13628.20380? If so, I will cease and desist trying to resolve it on my own. As stated earlier, I am able to get any other update I choose, just not this one.

Thanks in advance.
Jason Sandys 31,176 Reputation points Microsoft Employee

2021-02-11T19:01:08.033+00:00

Correct. The issue, to our knowledge, is restricted to the latest Microsoft 365 update. The fix should be on our end as well, so we aren't at this time expecting any changes by customers other than to reinitiate the download. That's still a bit TBD though so yep, holding pattern for now.
Aswani Kumar G 1 Reputation point

2021-02-12T06:26:11.19+00:00

Hi,

thanks for the update.

Was October 2020 CU Un-installed prior to upgrading SCCM CB with Hotfix Rollup KB4575789?

is it mandatory to uninstall this October 2020 CU?
Aswani Kumar G 1 Reputation point

2021-02-12T06:44:42.063+00:00

thanks for sharing the update.

I think there no official update from MS regarding this issue or "mentioning to Uninstall October 2020 CU from the servers".
people are suffering because of their patches and production applications are getting impacted and they are sitting idle, leaving us to suffer.
Jennings, Donna 6 Reputation points

2021-02-12T07:54:50.187+00:00

Hi, ours was fine after rerunning the ADR (with the Jan server CU updates installed on the site server) however we are not downloading updates for the latest M365 apps (Office) build, we are downloading for v2002, Jason's comments suggest the issue is only related to the latest version of M365 Apps and that they are working on a fix. Ours therefore must've been a different issue as we also had a different error code.
Jennings, Donna 6 Reputation points

2021-02-12T08:01:39.137+00:00

Hi, no there was no need to uninstall the October CU in order to update ConfigMgr as the ConfigMgr hotfix rollup contained the fix that allows the downloads to work with the CU installed. Prior to updating to 2006 however yes we did temporarily remove the Oct CU from a jump box with the ConfigMgr console installed just to enable us to download the M365 apps updates for that month and then we reinstalled the CU and updated ConfigMgr to 2006 a couple of weeks later before the next Patch Tuesday release.

Jason's comments:

"The issue, to our knowledge, is restricted to the latest Microsoft 365 update. The fix should be on our end as well, so we aren't at this time expecting any changes by customers other than to reinitiate the download. That's still a bit TBD though so yep, holding pattern for now"
Harji, Menesh 11 Reputation points

2021-02-12T10:09:26.01+00:00

We are still on 1910 and we have the same issue with the o365 Feb Patches. Do we know when this will be fixed
Darrell Shand 11 Reputation points

2021-02-12T10:11:15.407+00:00

Ive logged a call with MS support this morning, as jason said just hold until its fixed as its at their end
Henrik Thilander 6 Reputation points

2021-02-12T10:58:56.57+00:00

We are running CB 2010 with latest hotfixes KB4594176/4594177 and having the exakt the same problem when downloading x64/x86 (Microsoft 365 Apps Update - Current Channel Version 2101 for x86 based Edition (Build 13628.20380) and Microsoft 365 Apps Update - Current Channel Version 2101 for x86 based Edition (Build 13628.20380)
Failed to download content id xxxxxxxxx . Error: Invalid certificate signature. ADR error 0x80073633.
Darrell Shand 11 Reputation points

2021-02-12T14:37:10.11+00:00

MS support have said the fault is with unsigned .c2rx files. so all up to them to fix and redeploy the signed files i'm guessing
Jason Sandys 31,176 Reputation points Microsoft Employee

2021-02-12T16:06:55.917+00:00

This is correct. Please see my comment above.
Jason Sandys 31,176 Reputation points Microsoft Employee

2021-02-12T16:09:30.127+00:00

Please read the entire thread (as mottled as it is). We know of the issue and are working on a fix. The expectation is that the fix will be on our end only (as it's related to the content of the latest M365 Apps update and not functionality of ConfigMgr). No one is leaving you to suffer although is you feel you are suffering, then you need to open a support case.
Jason Sandys 31,176 Reputation points Microsoft Employee

2021-02-12T16:16:04.06+00:00

Going to close this thread after I post this answer and reiterate the information. We believe we understand the exact issue occurring. This new issue is only loosely related to the issue originally reported in this thread. We don't expect customers to have to change anything on their end as the issue is related to the content in the update and not ConfigMgr itself. As we work on implementing and validating the fix, please stand-by. If you are concerned about this message or the impact of the issue, please open a support case.
Ivan Radunković (Span) 1 Reputation point

2021-02-15T09:43:00.267+00:00

Where is new thread regarding O365 Updates?
Harji, Menesh 11 Reputation points

2021-02-16T08:55:48.793+00:00

Do we know when this will be fixed by MS

Accepted answer

Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-09T05:23:17.177+00:00

Note that 2006 hotfix rollup released last week addresses the download issue. If you aren't running 2006, I don't think you're going to see a fix.

See https://support.microsoft.com/en-us/help/4578605/update-rollup-for-microsoft-endpoint-configuration-manager-version-200
Please sign in to rate this answer.

2 people found this answer helpful.
Brian L99 1 Reputation point

2020-11-10T22:10:07.243+00:00

Jason,

Do you know if this would be the same issue for 2002 (Hotfix KB4553501). I have a CAS (don't ask why it's overkill, GEO/Political reasons) and something that worked last month does not today.

Worked in October: Microsoft 365 Apps Update - Semi-Annual Enterprise Channel Version 2002 for x86 based Edition (Build 12527.21236)
Failed in November: Microsoft 365 Apps Update - Semi-Annual Enterprise Channel Version 2002 for x86 based Edition (Build 12527.21330)

If this is the case I can use one of the workarounds listed. I just don't want to waste a couple days with a case or those workarounds and find out this issue is exclusive to 2006.

Thanks,
Brian

Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-11T01:57:10.107+00:00

Correct. Only the 2006 hotfix rollup released late last week addresses this and I know of no plans at this time about fixing this for any down-level versions of ConfigMgr. Our standard practice is not to issue fixes for down-level versions and to my knowledge, we never have in the CB era of ConfigMgr.

Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-11T16:53:03.48+00:00

Update: We are investigating the possibility of down-level CM updates for this. There would be a significant pain point for customers though so the investigation is on-going and no decision has been made. We strongly prefer orgs to upgrade to 2006 + HFRU to address this issue.

Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-11T22:27:30.027+00:00

I've already posted an update (it's on the next page of the answers if you aren't seeing it).

As for maintaining your software, that's the nature of software and security. This isn't about us intentionally breaking customers, it's about us keeping our products secure and thus our customer's as well. Sometimes, this breaks things and there are ramifications for all involved. There was no incompetence or malice involved here.

Brian L99 1 Reputation point

2020-11-12T16:03:31.403+00:00

Thanks Jason, that is what I suspected & your update too.

Do you know if 2020-11 2012r2 KB4586786 fixes this problem?

When I tried to download from the catalog, it gave me a link for "noop_a1aed054581993fcfb1085f8d08dde385566efc0.exe"???

I pulled the 600+ individual files for both the x86 and x64 version overnight. When I point to "\MyShare\365Apps\November\x64\7ffbc6bf-bc32-4f92-8982-f9dd17fd3114" I still get "Error: Invalid certificate signature".

I don't want to have to back out the 2020-10 patch because we are looking to deploy 2006 (and the hotfix) late December. Don't want to have to install/uninstall/reboot production systems multiples times as a workaround.

Thanks for any insight.
Brian

Brian L99 1 Reputation point

2020-11-12T17:00:47.477+00:00

Jason - Thanks, I see your comments further down in the thread of this conversation. I will evaluate best "next steps" for our company. I suspect it will be moving forward with the 2002 hotfix and dealing with the pain it causes to 2006 at that time.
Sign in to comment

14 additional answers

Brian L99 1 Reputation point

2020-11-12T18:53:04.413+00:00

Appreciate all the feedback from Jason. Always a great source of information.

What I failed to understand was where the certificate check was actually occurring. It wasn't until Jason said "Manual download of the update files is another and using a console installed on a workstation without the updates is a third option." that if finally sunk in. The certificate check was happening on the machine w/ the console installed, which is why even after downloading them I was still getting certificate errors.

I went to a Dev server, uninstalled the 2020-10 patch, and then rebooted. Installed the CM Console. Downloaded using the local files that I had downloaded manually. Everything worked fine.

I installed the 2020-11 CU for the 2012r2 server knowing I will probably have to repeat the same process until we can update to 2006 (and the then timely HFRU).

Thanks,
Brian
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
John Moore 1 Reputation point

2020-11-13T17:48:26.67+00:00

We have a 2002 environment and are seeing this exact issue. We can see this thread relates to 2006 but the same error codes appear in our logs and O365 will not download. According to the comments above it was stated that MS will not release a hotfix for 2002 to address this problem and only recommends upgrading to 2006. Has anyone else with 2002 seen this problem?
Is the only solution to remove the October updates?
Thanks
Please sign in to rate this answer.
Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-13T18:17:05.883+00:00

No, this no longer correct. We have released updates for 2002 and 1902:

https://support.microsoft.com/help/4575783
https://support.microsoft.com/help/4575784

Note the super-ugly, manual workarounds for subsequent upgrades though.

Despite these hotfixes, the best and recommend path here is upgrading to 2006 + HFRU.

John Moore 1 Reputation point

2020-11-16T21:17:44.047+00:00

We are on 2002 running a Primary site on a 2012R2. We are having this problem but looking at the installed patches for October we only see KB4578953, KB4578962 & KB4580347
We do not see KB4577668 installed on the server but yet we are having the exact same issue as explain here.
Do we need to remove one of the other patches?

Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-16T21:45:09.957+00:00

Is there a reason you aren't installing the ConfigMgr hotfix listed above or (better yet) upgrading to ConfigMgr 2006?

John Moore 1 Reputation point

2020-11-17T12:29:52.953+00:00

The hotfix for 2002 causes issues upgrading to 2006. Also we have to get approvals to upgrade to 2006 and verify there are no issues. To workaround we need to get the updates for Office downloading and then in two weeks we will have the approvals for upgrading to 2006.

Jason Sandys 31,176 Reputation points Microsoft Employee

2020-11-17T14:40:28.657+00:00

The hotfix for 2002 causes issues upgrading to 2006.

No, not really. The issue (singular) is well documented in the KB as is the proper path for addressing this issue when you upgrade -- it's an ugly workaround to be sure, but far from complicated.

If you need a temporary workaround, why not manually download the files as noted or use a console installed on a system that is only current with updates to September? The behavior causing the download issues isn't exclusive to the October updates anymore as they've been superseded by the November CU so you need to have a system that has no current updates (back to September as noted).

Brian L99 1 Reputation point

2020-11-18T18:36:27.19+00:00

We had the same exact issue on 2002. Below is from my comment in the thread about what we did and will do again in the December "Patch Tuesday" cycle. We are planning to upgrade our system to 2006 near the end of the year.

I went to a Dev server, uninstalled the 2020-10 patch, and then rebooted. Installed the CM Console. Downloaded using the local files that I had downloaded manually. Everything worked fine. I installed the 2020-11 CU for the 2012r2 server knowing I will probably have to repeat the same process until we can update to 2006 (and the then timely HFRU).

Have to remember the issue is not coming from your CAS/Primary, but rather the system where the Console is installed. As long as these updates are not installed on the system with the Console, appears to work as expected.

Best,
Brian

Abhishek Raghav 1 Reputation point Microsoft Employee

2020-11-26T04:06:16.77+00:00

For one of my customer on 2002 + KB 4560496: Update Rollup for Microsoft Endpoint Configuration Manager current branch, version 2002, still had same issue. Event uninstalling Oct and Nov patches didnt help.

Eventually, I figured the patchdownloader.dll in x86 and x64 directory were older version than what is mentioned in KB 4560496:

I simply replaced the patchdownloader.dll from 2006+patch setup to the 2002+patch and successfully downloaded the patch.
Sign in to comment

Share via

Failed to download content id. Error: invalid certificate signature. Authentication of file failed, error 0x800b0004. DownloadUpdateContent failed with hr=0x80073633.

14 additional answers