3

SSL with SHA2 does not work in windows XP SP2 and below.Th websites does not open if it has SSL with sha2. It requires SP3 and above. So is there any hotfix or files other than completely installing SP3 which will solve the problem?

1
  • Is there a workaround like using Firefox, which i think uses its own crypto library?
    – LatinSuD
    Oct 3, 2014 at 11:03

3 Answers 3

4

Proof of concept

As you probably know, Windows XP with SP3 is not supported anymore. By running XP SP2 or earlier, you're missing many fixes and some new features, too. Either way, plan to switch to a supported operating system whenever possible. If needed, you could still run XP in an isolated, virtual machine with no network access.

In case you're stuck with XP for whatever reason, consider at least updating it to SP3 and installing all subsequently released updates to reduce the attack surface as much as possible. Ensure any third-party software is up-to-date as well.

Back to the actual issue, SHA-2 wasn't available in Windows XP until SP3, where some limited support was introduced. Microsoft didn't backport the changes to earlier releases, and the only way to get the same results is by replacing the main cryptographic libraries (namely crypt32.dll and rsaenh.dll) with newer versions. There's no guarantee the resulting Frankenstein Edition would work as expected, and side effects might easily ensue. In the end, installing SP3 is the way to go.

The steps below were run on a clean Windows XP installation without service packs, but no extended testing was performed. They're for demonstration purposes only, so do not treat the following as a solution - especially in a production environment:

  1. Download the following updates. Make sure to select the language matching your system:

  2. Log on with an administrator account. Open a command prompt, and run the following commands:

    cd /d "X:\Folder\containing\updates"
    for /r %G in (*kb*.exe) do start "%~G" /wait "%~fG" /x:"%temp%\Extracted" /q
    expand "%temp%\Extracted\i386\rsaenh.dl_" "%userprofile%\Desktop\rsaenh.dll"
    copy "%temp%\Extracted\SP3QFE\crypt32.dll" "%userprofile%\Desktop"
    rd /s /q "%temp%\Extracted"
    

    Here are the basic details and hashes of the related US English files:

    File:    crypt32.dll
    Size:    589 KiB (603136 bytes)
    Version: 5.131.2600.6459
    ---
    CRC32:   af117a68
    MD5:     636df3ff20a1b69b3f9d21325e7115c7
    SHA1:    c6872705bb48b1f199ee98ac166ebf7be6721bb3
    SHA256:  6b38cf96e92273995f40b6d7029d20b4041342d6edd5b6ca73967a401823d4f5
    
    File:    rsaenh.dll
    Size:    203.5 KiB (208384 bytes)
    Version: 5.1.2600.5507
    ---
    CRC32:   3d3e2e74
    MD5:     54dae3ea34802b4ed9ae1c6b1209fa56
    SHA1:    8e8dd9db03ed502d915dee9e4f9fd3f10593e27c
    SHA256:  eeb1fa90db44c821b371d5f7c323b4f88e843107bba16da2acb124d6a848b257 
    
  3. Replace the files in the System32 folder with the newer copies, e.g. using a Linux live distribution. Make a backup of the original files before proceeding.

  4. Restart Windows, and try some test pages:

Screenshots

Before

XP RTM + IE6 - The page cannot be displayed

After

XP RTM + IE6 + library replacement - Working SHA-2 test page

Click for larger view.

Further reading

0
0

Short answer : "no".

Long answer : "No, not really - XP is an outdated, unstable and insecure operating system, please switch to a newer version."

Sources :

also :

Its time to move on. Now. If you refuse to keep up with development you'll be left behind and soon suffer the consequences - which is already happening as far as you're concerned. At some point in the future, you will have to disconnect your machine with XP on it from the internet because it would otherwise instantly be taken over / crash / something worse

If you liked XP that much you still can use it inside of a virtual machine - but please deactivate the virtual network cards while you're using it - heres a pretty good yet totally free VM-software : https://www.virtualbox.org/

4
  • This doesn't answer the question. "Move on" is not a proper response for "does a fix exist?" Oct 29, 2022 at 17:22
  • Its the next best thing to "no, absolutely not". Because thats the only "real" answer.
    – specializt
    Nov 16, 2022 at 14:26
  • No, it's not. The other answer answers the question properly. Nov 17, 2022 at 16:18
  • Your condescension doesn't make you correct. At no point does the question ask "should I stop using Windows XP?" Your short answer is the only valid answer you gave. The rest is answering a question that was not asked. This is a very simple concept. Nov 23, 2022 at 18:33
0

Yes, try Legacy Update it was designed to fix stuff like this.

1
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – Toto
    Dec 6, 2023 at 21:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .