Build & Capture Apply Updates failing after upgrade

[TimLancer]

I use Shavlik Patch with SCCM. In order for it to work I deploy a self-signed certificate and registry setting to allow these updates from WSUS. It works great. If I import the certificate and make the registry modification in an OSD TS, it installs the third-party updates during Apply Updates as well.

My issue is with Build & Capture. If I try the same method it fails with a certificate not trusted error - but this used to work with SCCM 2012R2.

I used to be on SCCM 2012R2 SP1 and was able to run my Build & Capture TS with an Apply Updates step. I know that the client will see all updates offered by WSUS (SCCM SUGs do not apply) and I could see in the logs and it would silently fail on just the third party updates published via Shavlik because it didn't trust the certificate. It was the best of both worlds because I could get my (fairly static) Office updates and it would ignore the (updated quite often) Shavlik ones.

After I upgraded to SCCM CB, my Build & Capture TS halted at the Apply Updates step because the certificate wasn't trusted. I'm not sure what caused this behavior because I upgraded SCCM, MDT, and the ADK to the latest versions at the same time. If I disable the Apply Updates step the Build & Capture TS works fine.

1. Any ideas why during OSD installing the cert fixes the certificate not trusted error - but during Build & Capture the same process does not? The only big difference I can think of is that the B&C machine isn't on the domain.
2. Does anyone bypass their local WSUS server and go out to Microsoft Update? I already have Windows updates installed via Offline Servicing but I'd love to avoid installing the same 30-40 Office updates every time. I figure if I bypass my local WSUS server then I might bypass this security certificate warning.