| Previous | Next |
| WU_E_METADATA_XML_VALIDITY_INVALID | WU_E_METADATA_XML_INTERMEDIATECERT_MISSING |
WU_E_METADATA_XML_LEAFCERT_MISSING
WU_E_METADATA_XML_LEAFCERT_MISSING means the verification configuration lacks the leaf signing certificate required to validate metadata signatures.
What to check
- Check the catalog or WSUS publishing process that created the configuration.
- Verify that the server did not return a truncated, stale, or partially synchronized metadata response.
- For private catalogs, ensure the intended signing certificate is present and distributed to clients through the approved trust stores.
The leaf certificate is tied to a metadata revision
Windows Update metadata integrity events expose a LeafCertId, hashes of leaf-certificate data or its public key, and the revision being validated. When the XML lacks required leaf-certificate data, preserve the revision, endpoint, and service identifiers so the missing element can be traced back to the metadata source rather than diagnosed as a generic certificate-store problem.
Check whether the same source serves valid metadata to another client and whether only one revision is affected. For a private publishing pipeline, validate the generated XML and signing configuration. Re-importing unrelated root certificates or resetting downloaded update content does not restore a leaf-certificate element that was never present in the metadata.
References
- Microsoft: Certificates and security for Updates Publisher
- Microsoft: Windows Update security
- Microsoft: Windows Update error reference
References
- Microsoft: leaf-certificate fields in update metadata integrity events
- Microsoft Open Specifications: extended update metadata fragments
Looking for a different code? Search another status or error code.