30

This question already has an answer here:

OS: Windows XP SP3. When I try to open the website brokerkf.ru in IE8, it says, that it can't find the server. While it opens google.com and many other websites.

Firefox and Chrome open brokerkf.ru without any problems. nslookup shows the website IP address correctly in the command prompt.

This domain is not in /etc/hosts file.

What could be the issue? I am puzzled.

marked as duplicate by Pimp Juice IT, phuclv, Jon, Braiam, Dmitry Grigoryev Sep 4 '17 at 9:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

80

Checking the SSLLabs TLS protocol support (found at https://www.ssllabs.com/ssltest/analyze.html?d=brokerkf.ru), this site only supports TLS 1.1 and TLS 1.2. The most recent version of TLS that IE8 supports is TLS 1.0. So effectively, IE8 and the site cannot agree on a version of TLS to use, and as such your browser cannot connect to the site.

Note that this is also the case for every other user agent which gets that type of failure: all those products only support TLS 1.0 as the most recent version, while the server doesn't support anything older than 1.1.

  • 5
    And as TLS 1.0 is broken, more and more sites are turning it off. You may be able to turn on TLS 1.1 or 1.2 deep in the browser options somewhere. Doesn't mean IE 8 will work on sites that haven't tested for it, though. – Peter Cooper Jr. Aug 31 '17 at 14:49
  • 5
    @PeterCooperJr. It's unlikely to be a case of "turning it on somewhere in the settings". The SSL/TLS component for Internet Explorer is actually part of the OS, and there are many features which Microsoft never backported to Windows XP (by the time TLS 1.1 came out, XP was 5 years old, and Vista was nearly ready for release). This table on Wikipedia suggests that TLS versions past 1.0 are among them: en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers – IMSoP Aug 31 '17 at 15:50
  • I had just vaguely remembered that some old versions of IE had TLS 1.1/1.2 as options, they were just off by default as they were too new and experimental at that time. Maybe IE 8 wasn't one of them. I didn't have a copy of XP anywhere handy to check. – Peter Cooper Jr. Aug 31 '17 at 16:17
  • 1
    The reason a server would be configured this way is because, a client can attack the server in such a way, where it downgrades to TLS 1.0 which of course is not considered safe. I use the word "attack", the context of performing any action, that has hostile intentions. If Windows XP has the ability to support TLS 1.1/1.2 it would have been added years ago, this will not happen, so you should move away from Windows XP if you have to use a browser on it. This limitation of being unable to use TLS 1.2 extends to ALL browsers by the way. – Ramhound Aug 31 '17 at 17:08
  • 4
    @Ramhound Only those browsers that depend on those OS provided libraries. I believe Firefox and Chrome contain the own SSL libraries. Not that either browser supports Windows XP anymore for new versions (the current Firefox LTS is last version that will support it, and will soon be unsupported too). – Alexander O'Mara Aug 31 '17 at 21:25
42

It seems the site is not supporting older useragents, which can only use outdated TLS, see here: https://www.ssllabs.com/ssltest/analyze.html?d=brokerkf.ru
The result shows, that for a lot of older browser versions the connection is closed by the server. So this is not an issue with the pc you are using, it's done by the webserver itself.

  • 49
    This answer is incorrect - as @Nzall says, they're not actively blocking anyone, let alone by user agent (which necessarily requires a connection be established and a request made first). They're just not going out of their way to support an older (insecure) protocol. So... yes, it is an issue with the client: the client is too old! – Bob Sep 1 '17 at 2:02
  • 3
    to say the answer is "incorrect" is also incorrect :-) (...unless being pedantic -- which is perfectly fine, if measured). Paraphrasing, yet likely still flawed, perhaps this is better phrasing: "Older user-agents are effectively blocked, since they do not support newer technology, and their attempts to connect to the server fail." – michael Sep 1 '17 at 2:46
  • 2
    @michael "_ to say the answer is "incorrect" is also incorrect :-) is incorrect_" (albeit pedantically). The site is blocking by SSL/TLS protocol, and some systems (in this case XP) don't support the required level (TLS1.1/1.2). While a "user agent" could provide its own implementation of the required protocols, many/most (including IE) don't and rely on the OS's implementation. – TripeHound Sep 1 '17 at 9:48
  • 2
    I don' think it's pedantic. The answer as given implies that they are intentionally blocking specific browser versions. They are not. They simply lack the older version of a protocol, and thus any browser without the newer versions can't connect to them. It really is an issue with the browser. – trlkly Sep 3 '17 at 2:30
  • 1
    @michael this answer is plain, simple, 100% inaccurate in addition to being misleading. – hobbs Sep 3 '17 at 17:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.