Please check if there is IIS for the virtual directory selfupdate under WSUS Adminitrator website. If not, u may manually create vitural directory (Remember, the default path is to be C:Program FilesUpdate ServicesSelfupdate) in IIS and giving it anonymous access. This is one way check. And of-course, restart the WUS.
Another way, I guess the downstream server is not a replica server, on replica downstream server obtains metadata and content from the upstream server, but perhaps, it could not obtain approvals from the upstream server. Only replica server can obtain approvals from the upstream server. Hopefully, u may do one thing, convert ds server to replica mode is to reinstall it. Hopefully, if a replica server is now can solve ur problems. I recommend u, kindly, visit <a href="http://technet.microsoft.com/en-us/library/cc720466(WS.10).aspx">Here</a> for Command Line helps. This is not exactly point ur problems, but u may gather knowledge from here on WSUS.
Thanks--