Question

I’m facing a strange problem (which is connected to this problem) regarding different certificate handling on XP and Windows 7 when using IE and/or programs that rely on wininet for accessing outside world.

1) When you try on XP with IE8 to connect to this site, IE refuses with “Cannot display the webpage” message.

2) If I use Chrome on XP (same page), it rises “Select a certificate to authenticate yourself…” *, and I can select a client certificate.

3) If I try to repeat this on Windows 7, with IE8 I get Windows Security dialog for selecting a certificate.

4) Chrome rises the same dialog as IE in step 3).

I suspect on security settings or group policies, but I’m kind of stuck.
Do you have any ideas on how to make it work on XP through IE8?

Answer 1

Check your IE8 settings on Windows XP. There was an update about a year ago that affects some of the defaults for IE under Windows XP.

1. Check “Advanced > Security” Use SSL 3.0 and TLS 1.0.
2. Also Internet Zone in Security custom level.

UPDATED

Your problem could be the supported ciphers by your web server not matching the capabilities of Windows XP. If Windows XP IE8 requests a cipher that is not permitted by your web server you will be unable to complete the handshake.

The list of supported ciphers for Windows XP are here http://msdn.microsoft.com/en-us/library/aa380512(v=vs.85).aspx.

1. To verify this try a packet capture.
2. To work around this you will likely have to enable extra ciphers in the Schannel registry keys for the web server. See http://support.microsoft.com/kb/245030 and reverse the instructions to enable a cipher supported by Windows XP. I know this is not ideal and there is good reasons why these are disabled.

This is not an issue under Chrome because it doesn’t use the Windows cryptographic providers. Naturally the newer versions of Windows support these.