Scan changes and certificates add security for Windows devices using WSUS for updates

AriaUpdated, I really wish the guidance for hardening our WSUS environments was more prescriptive.  The info you shared does not help your customers go out and take action today.  Many of your customers are not running the newest versions of your server OS on domain controllers so they will be baffled by not seeing a WSUS Certificate Store on a Server 2012 R2 (still supported by Microsoft).  So how many will spin their wheels looking for an in-depth posting on how to get that WSUS certificate on their PCs using Group Policy?  I didn't see any guidance in the WSUS documentation that many of us have used to setup our WSUS servers over the years... only a dozen or so "parrot sites" that scrap Microsoft content, but do not add any value.