> For the complete documentation index, see [llms.txt](https://docs.patchmypc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.patchmypc.com/patch-my-pc-publisher/requirements/certificate-requirements.md). # Certificate Requirements for Patch My PC Publisher *Applies to: Patch My PC Publisher V3.x* When working with Microsoft ConfigMgr or WSUS, correct certificate configuration is required to ensure that updates are trusted and considered secure by the platform. Microsoft enforces this by requiring all third-party and custom updates to be code signed before they can be published into WSUS. This applies specifically to the CAB files that contain update metadata and content. {% hint style="success" %} **Tip** Detailed guidance on certificate creation, selection, trust requirements, and lifecycle management is covered on the [Certificate Management](/patch-my-pc-publisher/manage/wsus-updates-tab/wsus-options/certificate-management.md) page. {% endhint %} To meet this requirement, Patch My PC (PMPC) Publisher must be provided with a code-signing certificate. This certificate is used to sign third-party updates during publishing, allowing WSUS and managed devices to validate the origin and integrity of the updates. Publisher supports multiple certificate configuration options to accommodate different organizational, security, and compliance requirements: * **ConfigMgr–managed certificate**\ When WSUS is used as part of a Software Update Point, Microsoft ConfigMgr can automatically generate and manage a self-signed WSUS signing certificate. This is the simplest and most commonly used option. * **Publisher-generated self-signed certificate**\ Publisher can create and manage its own self-signed code-signing certificate, which is commonly used in WSUS-only environments or where ConfigMgr is not available to manage the certificate. * **Customer-provided PKI certificate (PFX)**\ Organizations with stricter security or compliance requirements can provide a PFX file containing a code-signing certificate issued by an internal or public Certificate Authority. In most environments, allowing ConfigMgr or Publisher to manage a self-signed certificate is sufficient. However, for organizations that require certificate revocation, centralized PKI governance, or formal audit controls, importing a PKI-issued certificate may be necessary. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.patchmypc.com/patch-my-pc-publisher/requirements/certificate-requirements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.