NTLite Update Download Problem

[Clanger]

W7 host, NTLite 2023.11.9515x64, Windows Firewall(+WFC v6.9.9.1), UBlock for Firefox.
Updates for Windows 10 1809 x64

WFC rules
View attachment 10999

NTLite gets through the firewall to get its Update Lists and to download 2 updates
View attachment 11000

All the updates give this error except SSU and Intel Microcode Updates, which made me think it was a Host file issue.
View attachment 11001

Had a feeling that UBlock may have modified my Host file but it hasnt

Spoiler

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#    127.0.0.1       localhost
#    ::1             localhost

Hmm :/ Not a problem for me but it might be for others.

 

[nuhi]

Interesting, I have no issues downloading Win10 1809 updates.
It's like your HTTPS connection is somehow broken, potentially not updated root certificates or a TLS issue/not updated.

Is your host patched? Tampered with TLS/HTTPS policies?

Thanks.

 

[Clanger]

Windows 7 Pro SP1 x64 - 6.1.7601.19110, old Dell laptop.
All of your reply is beyond my knowledge so nothing would have been touched but (not)updated root certificates looks like the most probable cause. Old image build because i cannot trust a recent till EOES w7 capture(bad mobo).

Would need to know how to grab the latest root certificates using windows ? then test importing into an image.
If its a problem at my end and not a bug/outdated updates or MS servers issue then this thread just serves as information and how to solve if it is certificates.

edit
I can open "web articles" on the "problem" updates - the pages load fine, go to ms catalog and they download fine.
As long as i can connect to your server to get the lists im ok because a lot of the time im using Debian(live) to get online.
Only really using windows online for certain windows tools and where some have a specific .net requirement - Heidoc's Iso Downloader.

 

[Clanger]

Download the latest(?) and imported authroot.stl(right click - Install CTL - then rebooted) using this page(under the heading Certificate Trust List (STL) in Windows) and they still fail.

 

[abbodi86]

Win7 would need at least KB4490628+KB4474419 for proper Tls 1.2 support / sha2 certificates