Unable to download a Patch Update or Bulletin with error: The request was aborted: Could not create SSL/TLS secure channel.

Products

Patch Management Solution IT Management Suite Client Management Suite

Issue/Introduction

You may encounter scenarios where the Symantec Management Platform (SMP) cannot automatically download specific software update files due to proxy restrictions, firewall blocks, or retired vendor URLs.

There are a few times were you are unable to download patches from time to time. Sometimes it is an older Server OS hitting a new website (TLS / Cipher Suite issues), URL is not whitelisted through the Proxy, etc. There is a way to download the patch through another method, and then import the patch into the SMP. As an example of this situation, we will use Wireshark.

Error seen in the Console:

failed to download Software Update Package

Download failed for: SampleURL.com The remote server returned an error (403) Forbidden.

Wireshark Patches using the SMP Console. Customer checked with firewall team if any port is blocking the download from the Altiris Console but everything looks fine from their end. They are able to access the download link via browser from our computers and the SMP (The Download link is found in the SMP Logs - open LogViewer to review the logs).

We were able to use the PSPing command (included with Sysinternals PSTools) to validate customer has access to 2.na.dl.wireshark.org, and can download the files from a Browser when logged into the SMP with the Application Identification account.

You can also use Powershell Command Test-NetConnection <ipaddress> -port <port> to get similar results to PSPing. More information on Test-NetConnection: https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2025-ps

One thing that has changed, is that Wireshark updated the URL for download. Previous URL was www.wireshark.org and the new URL is 2.na.dl.wireshark.org. Customer's state that previous updates were staged just fine on the SMP.

Environment

Patch Management 8.x

Cause

If you have a Proxy: The remote server returned an error (403) Forbidden

From the SMP Logs we found that the download failed for: https://2.na.dl.wireshark.org/win64/Wireshark-win64-3.2.10.exe

Error message: The request was aborted: Could not create SSL/TLS secure channel.

We also see these download links, and their intended destination:

Start download [from:'https://2.na.dl.wireshark.org/win32/Wireshark-win32-3.4.6.exe' to:':\Program Files\..\Updates\WIRES34-210603\{82584f57-1ff4-4042-8866-04971aa0c13b}\Wireshark-win32-3.4.6.exe' task:Download Software Update Package]
Finished download [from:'https://2.na.dl.wireshark.org/win32/Wireshark-win32-3.4.6.exe' to:':\Program Files..\..\Updates\WIRES34-210603\{82584f57-1ff4-4042-8866-04971aa0c13b}\Wireshark-win32-3.4.6.exe'

Resolution

Resolution #1: Use Wireshark to determine the Cipher Suite that the Website requires, and then use IISCrypto (download from Nartac.com) to 'add' this Cipher Suite to the OS of the SMP Server (click Best Practices in IISCrypto usually works). See KB How to Get the Cipher Suite List Presented in Wireshark.

Resolution #2: If you're getting the (403) Forbidden error, then you may have a Proxy and this new URL may need to be Whitelisted on the Proxy. See the Error logs for the exact URL to add to the Whitelist.

Workarounds

Workaround #1.

Create a Software Package by Importing the Bulletin files as a new Software Package; then create a Managed Software Policy to deploy the Software Package, and finally create a Target of vulnerable systems.

Steps to complete the Workaround #1 using MANAGED SOFTWARE DELIVERY POLICY:

Download the Update files to any computer
1. The specific URL can be found in the SMP Logs for the patch you are trying to download. Alternatively, Google may be helpful
Copy the file over to the SMP
Use the Import Method to create a new Software Package
1. See Page 39 of KB Software Management Best Practices and Troubleshooting 8.5/8.6/8.7 for additional information and instructions
Create a Managed Software Delivery Policy to deploy the package to targeted systems.
1. See Page 77 of KB Software Management Best Practices and Troubleshooting 8.5/8.6/8.7 for additional instructions
Create a Target of systems to deploy
1. Pages 78 and 71 of KB Software Management Best Practices and Troubleshooting 8.5/8.6/8.7

Workaround #2

This method brings the update into Patch Management by recreating the expected file structure as if the files were downloaded by another SMP, and then importing those files into the current SMP.

In Part 1, we manually create the staging paths to import from (the Desktop works well for this).
In Part 2, we import the files from the Desktop into Patch Management.

As an example of how this works, we will use Wireshark and TeamViewer updates.

Part 1 – Manually create the staging paths and files

Open Altiris Log Viewer
- Start > Symantec > Altiris Log Viewer
Locate the failed download messages.
- If needed, use Find and search for the application name (for example Wireshark).
For each file download attempt you will typically see log entries similar to the following:
1. [1 / 4] Downloading Software Update Package [Wireshark-win64-X.X.XX.exe for WIRES34-XXXXX]
2. Start download [from:'https://2.na.dl.wireshark.org/win64/Wireshark-win64-X.X.X.exe'to:'X:..\...\Updates\WIRES34-XXXX\{<XXXXXXX-some-GUID>}\Wireshark-win64-X.X.X.exe'task:Download Software Update Package]
These log messages provide the following information:

Information	Description
Number of files	Total files included in the update download
Bulletin name	The Patch Management bulletin being processed
Update GUID	The GUID associated with the specific update package
Source URL	Location where the file is downloaded from (`from:`)
Expected filename	Filename that Patch Management expects (`to:` path)

Important clarifications

- The GUID shown in the log entry refers to the Update GUID, not the Bulletin GUID.
- The file name that must exist in the staging folder is the one shown in the to: path, not necessarily the name from the download URL.
- Some software update files are renamed when Patch Management processes them. When this occurs, the file must be renamed to match the filename in the to: portion of the log entry.

Example from Altiris log:

Start download [from:'https://dl.teamviewer.com/download/version_15x/TeamViewer_Host_Setup.exe?15.75.4.0'
to:'C:\Program Files\Altiris\Patch Management\Packages\Updates\TVIEW15-260225
{535a7d54-4db1-44bf-8362-23974f7edc33}
TeamViewer_Host_Setup_15.75.4.0_x86.exe'
task:Download Software Update Package]

In this example:

Source	File Name
From URL	`TeamViewer_Host_Setup.exe`
Expected by Patch Management	`TeamViewer_Host_Setup_15.75.4.0_x86.exe`

Therefore:

- Download TeamViewer_Host_Setup.exe
- Rename the file to TeamViewer_Host_Setup_15.75.4.0_x86.exe
- Place it into the correct {UpdateGUID} folder.

Create a folder named Updates on the Desktop (or another accessible location).
Using the information from the log file, recreate the expected folder structure in the Updates folder.

Structure format:

Updates\BulletinName\{UpdateGUID}

Example:

C:\Users\<User>\Desktop\Updates\TVIEW15-260225\{535a7d54-4db1-44bf-8362-23974f7edc33}

Note:

- The bulletin name and Update GUID will differ for each release.
- Include the curly braces { } around the GUID exactly as shown in the log entry.

Download the file from the URL shown in the from: portion of the log entry using a web browser.
Rename the downloaded file if necessary so that it matches the filename shown in the to: path in the log entry.
Place the renamed file into the recreated folder structure:

..\Desktop\Updates\BulletinName\{UpdateGUID}\ExpectedFileName.exe
Repeat Steps 6–9 for each file until all files listed in the log entries have been downloaded and placed in the correct {UpdateGUID} folder.
After completing these steps, the required file structure will exist locally, allowing the files to be imported into the SMP Server.

Example structure created after downloading a Wireshark bulletin named Wireshark-YYMMDD:

Desktop
└ Updates
└ Wireshark-YYMMDD
└ {UpdateGUID}
└ Wireshark-win64-X.X.X.exe

After completing these steps, the required staging file structure will exist and can be imported into Patch Management in Part 2.

Part 2 – Importing the staged files into the SMP

Open the SMP Console and navigate to:

Settings > All Settings > Software > Patch Management > Core Services

In Core Services, temporarily redirect the download source to the local staging folder.
Enable:

Download from staging location

Enter the path where the files were created, for example:

C:\Users\<User>\Desktop\Updates

Click Save changes.

Ensure the Application ID has permission to access the staging location.

Options:

Select Use Application Credentials, or
Provide credentials that have access to the staging directory.

In the Patch Remediation Center, locate the desired Wireshark bulletin and click:

Download Packages

The files should now be retrieved from the Desktop\Updates staging location.

After the download completes, return to Core Services and uncheck:

Download from staging location

Click Save changes.

Verify the files were placed in the Patch Management package repository, typically:

..\Program Files\Altiris\Patch Management\Packages\Updates

The structure should appear similar to:

BulletinName\{UpdateGUID}\File.exe

At this point, the update packages are available in Patch Management and can be used to:

Create a Patch Policy
Distribute updates to targeted systems

via the Patch Remediation Center.

Additional Information

This is similar to using Patch Management without an Internet Connection: KB Configuring Patch Management 8.x to operate without an internet connection. We're just creating the Import file structure instead of using another SMP to stage the downloads which would also create the same file structure.

For troubleshooting Cipher Suite issues, it is also possible to use Wireshark to tell us what Cipher Suites the Client and Server support. See KB How to Get the Cipher Suite List Presented in Wireshark. If you can make changes to the OS Cipher Suites, this may be helpful.