3

SSL with SHA2 does not work in windows XP SP2 and below.Th websites does not open if it has SSL with sha2. It requires SP3 and above. So is there any hotfix or files other than completely installing SP3 which will solve the problem?

  • Is there a workaround like using Firefox, which i think uses its own crypto library? – LatinSuD Oct 3 '14 at 11:03
3

Proof of concept

As you probably know, Windows XP with SP3 is not supported anymore. By running XP SP2 or earlier, you're missing many fixes and some new features, too. Either way, plan to switch to a supported operating system whenever possible. If needed, you could still run XP in an isolated, virtual machine with no network access.

In case you're stuck with XP for whatever reason, consider at least updating it to SP3 and installing all subsequently released updates to reduce the attack surface as much as possible. Ensure any third-party software is up-to-date as well.

Back to the actual issue, SHA-2 wasn't available in Windows XP until SP3, where some limited support was introduced. Microsoft didn't backport the changes to earlier releases, and the only way to get the same results is by replacing the main cryptographic libraries (namely crypt32.dll and rsaenh.dll) with newer versions. There's no guarantee the resulting Frankenstein Edition would work as expected, and side effects might easily ensue. In the end, installing SP3 is the way to go.

The steps below were run on a clean Windows XP installation without service packs, but no extended testing was performed. They're for demonstration purposes only, so do not treat the following as a solution - especially in a production environment:

  1. Download the following updates. Make sure to select the language matching your system:

  2. Log on with an administrator account. Open a command prompt, and run the following commands:

    cd /d "X:\Folder\containing\updates"
    for /r %G in (*kb*.exe) do start "%~G" /wait "%~fG" /x:"%temp%\Extracted" /q
    expand "%temp%\Extracted\i386\rsaenh.dl_" "%userprofile%\Desktop\rsaenh.dll"
    copy "%temp%\Extracted\SP3QFE\crypt32.dll" "%userprofile%\Desktop"
    rd /s /q "%temp%\Extracted"
    

    Here are the basic details and hashes of the related US English files:

    File:    crypt32.dll
    Size:    589 KiB (603136 bytes)
    Version: 5.131.2600.6459
    ---
    CRC32:   af117a68
    MD5:     636df3ff20a1b69b3f9d21325e7115c7
    SHA1:    c6872705bb48b1f199ee98ac166ebf7be6721bb3
    SHA256:  6b38cf96e92273995f40b6d7029d20b4041342d6edd5b6ca73967a401823d4f5
    
    File:    rsaenh.dll
    Size:    203.5 KiB (208384 bytes)
    Version: 5.1.2600.5507
    ---
    CRC32:   3d3e2e74
    MD5:     54dae3ea34802b4ed9ae1c6b1209fa56
    SHA1:    8e8dd9db03ed502d915dee9e4f9fd3f10593e27c
    SHA256:  eeb1fa90db44c821b371d5f7c323b4f88e843107bba16da2acb124d6a848b257 
    
  3. Replace the files in the System32 folder with the newer copies, e.g. using a Linux live distribution. Make a backup of the original files before proceeding.

  4. Restart Windows, and try some test pages:

Screenshots

Before

XP RTM + IE6 - The page cannot be displayed

After

XP RTM + IE6 + library replacement - Working SHA-2 test page

Click for larger view.

Further reading

2

Short answer : "no".

Long answer : "No, not really - XP is an outdated, unstable and insecure operating system, please switch to a newer version."

Sources :

also :

Its time to move on. Now. If you refuse to keep up with development you'll be left behind and soon suffer the consequences - which is already happening as far as you're concerned. At some point in the future, you will have to disconnect your machine with XP on it from the internet because it would otherwise instantly be taken over / crash / something worse

If you liked XP that much you still can use it inside of a virtual machine - but please deactivate the virtual network cards while you're using it - heres a pretty good yet totally free VM-software : https://www.virtualbox.org/

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.