2

I'm researching the impact of changing a site's SSL certificates to SHA-2 hash in order to avoid the "obsolete cryptography" from Chrome.

I found this page, which contains a table of OSs and browsers that are compatible with SHA-2 certificates:

https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility

The one i'm mostly concerned about is Windows XP pre-SP3.

Does anyone have a screen shot or the wording of the error that happens when a pre-SP3 XP system with, say, Chrome, Opera or IE, tries to access a https page in a site that has a SHA-2 cert?

thanks

glauber ribeiro

7
  • Firefox certificate handling is independent from the OS, so no worry about this browser. You might of course still stumble over an unsupported legacy version of Firefox on such unsupported legacy systems. May 18, 2015 at 16:28
  • OK, removing Firefox from the question.
    – theglauber
    May 18, 2015 at 16:58
  • Does anyone concerned about encryption and security even have a Windows XP (with or without SP3)? May 18, 2015 at 17:09
  • Exactly, I'm trying to locate an archived XP SP2 VM.
    – theglauber
    May 18, 2015 at 17:11
  • As fast as the security situation for XP continues to degrade (RC4 finally bit the dust), I don't expect the few holdouts to be able to continue much longer
    – Machavity
    May 18, 2015 at 17:15

2 Answers 2

3

You may still have some XP traffic, but pre-sp3 traffic should be quite minimal. In any case, here are screenshots of Chrome 1.0 and IE6 on Windows Server 2003 with SP2 without MS13-095 applied, which would add SHA-256 browser compatibility. The error on an XP SP2 machine should be identical.

Chrome 1.0 on Server 2k3 SP2:

enter image description here

IE 6 on Server 2k3 SP2:

enter image description here

As noted on the compatibility page, Chrome 1-37 rely on the OS for compatibility. Chrome 38+ will support SHA-2 on its own regardless of OS support.

You won't see a "certificate error" because it can't establish a secure connection in the first place.

1
  • Also to elaborate on the "obsolete cryptography" warning in Chrome. That is actually separate from your certificate. That has to do with the cipher suites that you have enabled on your server to handle the key exchange and message encryption/authentication. See here: security.stackexchange.com/questions/83831/… May 18, 2015 at 18:21
2

I don't have a screen shot but shortly after we switched to SHA-2 we had a customer call in complaining that she was getting an "Invalid Certificate" screen in IE8. I never got the impression that the error was anything different from trying to access any other invalid certificate. Here's what the generic message looks like


(source: technet.com)

1
  • 1
    As an addendum, in nearly 2 years since that has been the only complaint we've ever gotten. Since Jan 1, XP represents just over 3% of our traffic
    – Machavity
    May 18, 2015 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .