2

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome.

I found this page, which contains a table of OSs and browsers that are compatible with SHA-2 certificates:

https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility

The one i'm mostly concerned about is Windows XP pre-SP3.

Does anyone have a screen shot or the wording of the error that happens when a pre-SP3 XP system with, say, Chrome, Opera or IE, tries to access a https page in a site that has a SHA-2 cert?

thanks

glauber ribeiro

  • Firefox certificate handling is independent from the OS, so no worry about this browser. You might of course still stumble over an unsupported legacy version of Firefox on such unsupported legacy systems. – Steffen Ullrich May 18 '15 at 16:28
  • OK, removing Firefox from the question. – theglauber May 18 '15 at 16:58
  • Does anyone concerned about encryption and security even have a Windows XP (with or without SP3)? – Hagen von Eitzen May 18 '15 at 17:09
  • Exactly, I'm trying to locate an archived XP SP2 VM. – theglauber May 18 '15 at 17:11
  • As fast as the security situation for XP continues to degrade (RC4 finally bit the dust), I don't expect the few holdouts to be able to continue much longer – Machavity May 18 '15 at 17:15
3

You may still have some XP traffic, but pre-sp3 traffic should be quite minimal. In any case, here are screenshots of Chrome 1.0 and IE6 on Windows Server 2003 with SP2 without MS13-095 applied, which would add SHA-256 browser compatibility. The error on an XP SP2 machine should be identical.

Chrome 1.0 on Server 2k3 SP2:

enter image description here

IE 6 on Server 2k3 SP2:

enter image description here

As noted on the compatibility page, Chrome 1-37 rely on the OS for compatibility. Chrome 38+ will support SHA-2 on its own regardless of OS support.

You won't see a "certificate error" because it can't establish a secure connection in the first place.

  • Also to elaborate on the "obsolete cryptography" warning in Chrome. That is actually separate from your certificate. That has to do with the cipher suites that you have enabled on your server to handle the key exchange and message encryption/authentication. See here: security.stackexchange.com/questions/83831/… – Gregordinary May 18 '15 at 18:21
2

I don't have a screen shot but shortly after we switched to SHA-2 we had a customer call in complaining that she was getting an "Invalid Certificate" screen in IE8. I never got the impression that the error was anything different from trying to access any other invalid certificate. Here's what the generic message looks like

http://blogs.technet.com/cfs-file.ashx/__key/CommunityServer-Blogs-Components-WeblogFiles/00-00-00-76-18-metablogapi/8524.wes072510011_5F00_3590B192.jpg

  • 1
    As an addendum, in nearly 2 years since that has been the only complaint we've ever gotten. Since Jan 1, XP represents just over 3% of our traffic – Machavity May 18 '15 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.