Please check if there is IIS for the virtual directory self update under WSUS Administrator website. If not, you may manually create virtual directory (Remember, the default path is to be C:\Program Files\Update Services\Selfupdate) in IIS and giving it anonymous access. This is one way check. And of-course, restart the WUS.
Another way, I guess the downstream server is not a replica server, on replica downstream server obtains metadata and content from the upstream server, but perhaps, it could not obtain approvals from the upstream server. Only replica server can obtain approvals from the upstream server. Hopefully, you may do one thing, convert ds server to replica mode is to reinstall it. Hopefully, if a replica server is now can solve your problems. I recommend you, kindly, visit here for Command Line help. This is not exactly point your problems, but you may gather knowledge from here on WSUS.