Someone gave me a Windows XP 5.1.2600 laptop that works fine when booting
but I can't yet find a browser for it that will connect to the Interbnet.

Also I can only use Wi-Fi security from my phone where I can set the
security to none since it won't connect to any modern Wi-Fi WPA2-PSK router
security (I'm traveling so I don't have access to my own router).

Start > Run > winver
Version 5.1 (build 2600.xpsp_sp3_dgr_130307-0422 : Service Pack 3)

My two main questions are really a result of the first problem.
(1) How can I get a web browser for that WinXP that works on the Internet?
(2) How can I get that WinXP to connect to a typical WPA2-PSK access point?

"Lawrence Aracabia" <LawrenceAracabia@Aracabia.com> wrote

| My two main questions are really a result of the first problem.
| (1) How can I get a web browser for that WinXP that works on the Internet?
| (2) How can I get that WinXP to connect to a typical WPA2-PSK access
point?

I'm using Firefox 52.9 and New Moon 28.10.

http://archive.mozilla.org/pub/firefox/releases/

I don't know about the router issue.

On Mon, 15 Nov 2021 02:13:51 +0100, Lawrence Aracabia
<LawrenceAracabia@Aracabia.com> wrote:

>Someone gave me a Windows XP 5.1.2600 laptop that works fine when booting
>but I can't yet find a browser for it that will connect to the Interbnet.
>
>Also I can only use Wi-Fi security from my phone where I can set the
>security to none since it won't connect to any modern Wi-Fi WPA2-PSK router
>security (I'm traveling so I don't have access to my own router).
>
>Start > Run > winver
>Version 5.1 (build 2600.xpsp_sp3_dgr_130307-0422 : Service Pack 3)
>
>My two main questions are really a result of the first problem.
>(1) How can I get a web browser for that WinXP that works on the Internet?
>(2) How can I get that WinXP to connect to a typical WPA2-PSK access point?

Is the WiFi radio enabled? Does it see any networks?
Will it work with a cable in the ethernet port?
That will get you started down the right path.
If the ethernet works you have a WiFi thing. I would start by looking
for a WiFi switch. There is probably an LED that says the radio is on.
Then look at the control panel and see what it says about a WiFi
connection.
You may be reloading a driver or something if the hardware looks OK.

On Mon, 15 Nov 2021 00:45:18 -0500, gfretwell@aol.com wrote as
underneath :

>On Mon, 15 Nov 2021 02:13:51 +0100, Lawrence Aracabia
><LawrenceAracabia@Aracabia.com> wrote:
>
>>Someone gave me a Windows XP 5.1.2600 laptop that works fine when booting
>>but I can't yet find a browser for it that will connect to the Interbnet.
>>
>>Also I can only use Wi-Fi security from my phone where I can set the
>>security to none since it won't connect to any modern Wi-Fi WPA2-PSK router
>>security (I'm traveling so I don't have access to my own router).
>>
>>Start > Run > winver
>>Version 5.1 (build 2600.xpsp_sp3_dgr_130307-0422 : Service Pack 3)
>>
>>My two main questions are really a result of the first problem.
>>(1) How can I get a web browser for that WinXP that works on the Internet?
>>(2) How can I get that WinXP to connect to a typical WPA2-PSK access point?
>
>Is the WiFi radio enabled? Does it see any networks?
>Will it work with a cable in the ethernet port?
>That will get you started down the right path.
>If the ethernet works you have a WiFi thing. I would start by looking
>for a WiFi switch. There is probably an LED that says the radio is on.
>Then look at the control panel and see what it says about a WiFi
>connection.
>You may be reloading a driver or something if the hardware looks OK.

A modern Wi-Fi dongle(USB) should have the necessary WPA2 software and
firmware to run correctly on XP, I don't think you will be able to find
modern drivers for XP age wireless internal card, as a work around for
that part of your problem, and just disable the old internal Wi-Fi card.
C+

On Mon, 15 Nov 2021 02:13:51 +0100, Lawrence Aracabia
<LawrenceAracabia@Aracabia.com> wrote:

>My two main questions are really a result of the first problem.
>(1) How can I get a web browser for that WinXP that works on the Internet?

I use three browsers with Win XP.

I use Firefox v41 where possible, but it says many sites have insecure
connections. Some will allow you to connect anyway, others dfon't.

I use Maxthon for Facebook and FamilySearch, though it is slow and
clunky and keeps missing or losing the connection to the DNS server.
And Avast blocks many sites because they have not updated their
certificate and so are insecure.

I use Opera for Twitter, and a few other sites. It connects with
Facebook, but Facebook will not allow it to comment -- it can reply to
other comments, though. It also reports lots of problems with sites
with expired certificates.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

On Mon, 15 Nov 2021 07:03:43 +0000, Charlie+ <charlie@xxx.net> wrote:

>On Mon, 15 Nov 2021 00:45:18 -0500, gfretwell@aol.com wrote as
>underneath :
>
>>On Mon, 15 Nov 2021 02:13:51 +0100, Lawrence Aracabia
>><LawrenceAracabia@Aracabia.com> wrote:
>>
>>>Someone gave me a Windows XP 5.1.2600 laptop that works fine when booting
>>>but I can't yet find a browser for it that will connect to the Interbnet.
>>>
>>>Also I can only use Wi-Fi security from my phone where I can set the
>>>security to none since it won't connect to any modern Wi-Fi WPA2-PSK router
>>>security (I'm traveling so I don't have access to my own router).
>>>
>>>Start > Run > winver
>>>Version 5.1 (build 2600.xpsp_sp3_dgr_130307-0422 : Service Pack 3)
>>>
>>>My two main questions are really a result of the first problem.
>>>(1) How can I get a web browser for that WinXP that works on the Internet?
>>>(2) How can I get that WinXP to connect to a typical WPA2-PSK access point?
>>
>>Is the WiFi radio enabled? Does it see any networks?
>>Will it work with a cable in the ethernet port?
>>That will get you started down the right path.
>>If the ethernet works you have a WiFi thing. I would start by looking
>>for a WiFi switch. There is probably an LED that says the radio is on.
>>Then look at the control panel and see what it says about a WiFi
>>connection.
>>You may be reloading a driver or something if the hardware looks OK.
>
>A modern Wi-Fi dongle(USB) should have the necessary WPA2 software and
>firmware to run correctly on XP, I don't think you will be able to find
>modern drivers for XP age wireless internal card, as a work around for
>that part of your problem, and just disable the old internal Wi-Fi card.
>C+

My old XP Thinkpad doesn't have any problem using Firefox and the
drivers that came with it. I have connected to routers all over the
country. I only stopped using it because the plane wants W/7 to get to
the entertainment. (Delta GoGo)

Mayayana <mayayana@invalid.nospam> wrote:

> I'm using Firefox 52.9 and New Moon 28.10.

I tried Firefox and it still wouldn't connect to httpS web sites.

There seems to be a problem with old "certificates" as only http sites
work. The laptop had not been used in probably 10 or 15 years.

Is there a way to "check" & "update" the certificates for any given
browser?

<gfretwell@aol.com> wrote:

> Is the WiFi radio enabled?

Yes. I can connect to an open network just fine (which is why I must use my
phone as I'm traveling and therefore I have no access to anyone's router).

> Does it see any networks?

Yes. It sees all of them. It just doesn't have WPA2-PSK ability.

> Will it work with a cable in the ethernet port?
> That will get you started down the right path.

I don't have physical access to anyone's router but that isn't the problem
anyway since it won't connect to WPA2-PSK as it doesn't even have that
option.

> If the ethernet works you have a WiFi thing.

The Wi-Fi clearly doesn't support WPA2-PSK. That's all I need.
I'm just not familiar with HOW to get it, especially with all the browser
certificates expired.

> I would start by looking for a WiFi switch. There is probably an LED that says the radio is on.
> Then look at the control panel and see what it says about a WiFi
> connection.
> You may be reloading a driver or something if the hardware looks OK.

The laptop hasn't been used in 10 or 15 years which is apparently older
than WPA2-PSK existed so all it needs is that capability but I don't know
how to add it.

On 11/14/2021 8:13 PM, Lawrence Aracabia wrote:
> Someone gave me a Windows XP 5.1.2600 laptop that works fine when booting
> but I can't yet find a browser for it that will connect to the Interbnet.
>
> Also I can only use Wi-Fi security from my phone where I can set the
> security to none since it won't connect to any modern Wi-Fi WPA2-PSK router
> security (I'm traveling so I don't have access to my own router).
>
> Start > Run > winver
> Version 5.1 (build 2600.xpsp_sp3_dgr_130307-0422 : Service Pack 3)
>
> My two main questions are really a result of the first problem.
> (1) How can I get a web browser for that WinXP that works on the Internet?
> (2) How can I get that WinXP to connect to a typical WPA2-PSK access point?
>

A popular security certificate expired not long ago,
and this has caused major browser havoc for WinXP.

ISRG... Not the LetsEncrypt itself.

https://web.archive.org/web/20210922081352/https://techcrunch.com/2021/09/21/lets-encrypt-root-expiry/

*******

Using a second computer running a newer OS, consider acquiring
Firefox 52ESR. There's a table of values here, and this site
thinks Firefox > 50 will work. Since WinXP only has a working
Firefox up to 52ESR, then that is as far as you can go.

https://support.freshteam.com/support/solutions/articles/19000130292-troubleshooting-connection-not-secure-error

>50, <= 52ESR

So that would be here.

http://releases.mozilla.com/pub/firefox/releases/52.9.0esr/win32/en-US/

Firefox Setup 52.9.0esr.exe 43M 25-Jun-2018 08:56

Why is there a SHA1 reference here ? Dunno. This could be the same file.

http://releases.mozilla.com/pub/firefox/releases/52.9.0esr/win32-sha1/en-US/

Firefox Setup 52.9.0esr.exe 43M 25-Jun-2018 08:57

The reason Firefox can work, is Firefox has its own certificate store.

I tested the item from the first download link, and at least
it installed. I can't tell whether it will open the broken sites
or not. But you can try it. Once you get a cable or the Wifi working.

I had major problems with Windows Update in WinXP. There is a looping
bug, which presumably some clever Microsoft employee had a hand in.
The server it is trying to reach, is an http one, but perhaps
there is an https redirect and it doesn't even bother showing what it has
done on the screen.

I tried to use my wsusoffline, made a number of years ago, but
maybe I have to pick up an ESR from the site and get the
latest changes, if anyone bothered. They're not really supposed
to be supporting that any more. Wsusoffline consults Windows Update,
so does not "force" the updates in, which is a shame, because
as soon as Microsoft ruins WU, then Wsusoffline is ruined too.

Even if I installed MBSA 2.3, the wsusscn2.cab is protected with SHA2
now, and MBSA 2.3 cannot handle that. It should be dead in the water
too, not because the software is broken, but because the .cab it
is downloading is boobytrapped (designed to fail, when parsed).

Summary: Running WinXP ? Good God. It's like a field full of land mines now.
What a mess. So if someone tells you to "clean install when buying
a used laptop", I think you know what my answer is for WinXP...

Find a copy of Win7 and DAZ Loader.

Paul

"Lawrence Aracabia" <LawrenceAracabia@Aracabia.com> wrote

| I tried Firefox and it still wouldn't connect to httpS web sites.
| | There seems to be a problem with old "certificates" as only http sites
| work. The laptop had not been used in probably 10 or 15 years.
| | Is there a way to "check" & "update" the certificates for any given
| browser?

I updated mine according to this webpage:

https://msfn.org/board/topic/175170-root-certificates-and-revoked-certificates-for-windows-xp/

I don't know whether it made a critical difference. Maybe it did.
But there's also the issue of bad certs and you need to make sure
FF gives you the option to bypass its warnings. I don't remember
the details of that offhand, but in some cases you can just get
a refusal to load the page. Yet in most cases that's due to recently
outdated certs or certs a small website is using that are not in its
name.

Mayayana <mayayana@invalid.nospam> wrote:

> I updated mine according to this webpage:
>
> https://msfn.org/board/topic/175170-root-certificates-and-revoked-certificates-for-windows-xp/

Thanks for that advice as I think the problem with the WinXP web browsers is that there are no
valid certificates, and I think the problem with the WinXP wi-fi may be that there is no option
to set the security to WPA2-PSK (or even WPA2 since it goes by various names).

(1) I created the phone mobile hotspot "hotspot1" which I set with no protection
(2) I ran in the phone termux shell "ifconfig" whose results are below
(3) "inet 192.168.27.227 netbask 255.255.255.0 broadcast 192.168.27.227"
(4) I connected winxp wi-fi to that mobile phone access point "hotspot1"
(5) The winxp "ipconfig" showed the wrong IP address subnet so I rebooted
(6) Back up & on Wi-Fi, the WinXP subnet was still wrong at 192.168.86.229
(7) A winxp ipconfig /release and then /renew didn't help things at all
(8) I set WinXP for the same 27 subnet & 227 gateway via the control panel
(9) 192.168.27.229/255.255.255.0 & gateway 192.168.27.227 & DNS 8.8.8.8/8.8.4.4
(10) On WinXP I pinged 192.168.27.227 & www.google.com successfully
(11) On WinXP I brought up firefox esr 52.9.0 (32-bit)
(12) In FF 52.9.0 I went to https://msfn.org (note the httpS)
(13) Predictably the error was "Your connection is not secure"
(14) In FF I pressed Advanced, Add Exception, Get Certificate,& Confirm Security Exception" and the home page came up.
(15) In FF I went to your helpful URL & read the moderator comment below

The download for the latest (1.6) version of Heinoganda's root certificates and revoked certificates update utility is here -
https://www.mediafire.com/file/pflkq12ik8tlx5w/jveWB2Qg1Lt9yT5m3CYpZ8b8N4rH.rar/file
The archive password is: S4QH5TIefi7m9n1XLyTIZ3V5hSv4se1XB6jJZpH5TfB6vkJ8hfRxU7DWB2p

(16) Going to that mediafire URL I again got "Your connection is not secure"
(17) I hit Advanced, Add Exception, Get Certificate, Confirm Security Exception
(18) I pressed the blue "Download" button labeled jveWB2Qg1Lt9yT5m3CYpZ8b8N4rH
(19) Again I received "Your connection is not secure" & again I added the certificate.
(20) That downloaded the following 1,659KB RAR file
https://download2279.mediafire.com/blogpk1hizug/pflkq12ik8tlx5w/jveWB2Qg1Lt9yT5m3CYpZ8b8N4rH.rar
(21) Right clicking and selecting IZArc to extract asked for the password shown above
(22) The "Important please read.txt" implied I should ignore the "DL_URL_UPD.reg" file
(23) The "Info Version 1.6.txt" provided version information (bugfixes & the like)
(24) I clicked on the remaining file "Cert_Updater_v1.6.exe" & pressed "Yes"
(25) Resulting in "Roots Certificates" & "Revoked Certificates" are "successfuyllty updated"

I went to www.oogle.com in FF 52.9.0 and it still said it was an insecure connection.
I killed and restarted Firefox ESR 52.9.0 (32-bit) but it still said the same thing.
That still said "insecure connection" so I rebooted WinXP.
After I restarted WinXP and reconnected, FF STILL gives me that insecure connection warning.
So I did a "Turn Off" of the PC so that I could cold boot to Windows XP.

After the cold boot I connected Windows XP SP3 to the phone wi-fi access point.
I checked the ping to the phone gateway and to www.google.com and they worked fine.
Yet Firefox 52.9.0 ESR (32-bit) STILl complained about security
https://www.google.com/?gws_rd=ssl
But the error is different now:
Error code: MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE
Clicking on those words it says:
A certificate that is not yet valid was used to issue the server's certificate.
HTTP Strict Transport Security: false
HTTP Public Key Pinning: true
I checked the date of the Windows XP computer and it said "Sat 07/09/2016"
which I then changed to 11-15-21 (and I checked that it took which it did).

THEN, when I went to "www.google.com' in Firefox ESR 52.9.0 (32-bit), it worked!
I went to news.google.com so I could click on current links, which worked!
SRWARE Iron Version 49.0.2600.0 also worked when clicking around in news.google.com!
Internet Explorer 8 version 8.0.6001.18702 also worked albeit it was super slow.
Worse with Opera 36.0.2130.80 which hung every time that on news.google.com site.

After another cold boot I checked again before posting my results above.
(The current date stuck, so it looks like the PC hasn't been used since 2016.)

Was my browser problem, all along, that the date was stuck way back in 2016?
Even so, when I connect to a typical home WPA2-PSK secured access point, I get
"Windows was unable to find a certificate to log you on to the network"

When I try to set up the wi-fi connection the only choices winxp provides are
Automatically assign a network key (recommended)
Manually assign a network key
Use WPA encrfyption instgead of WEP

Overall, were all my web problems only related to the date or to the certificates?
And, how do I get the option for WPA2-PSK encryption in Windows XP SP3?

On 11/15/2021 10:55 AM, Lawrence Aracabia wrote:

>
> Overall, were all my web problems only related to the date or to the certificates?
> And, how do I get the option for WPA2-PSK encryption in Windows XP SP3?

There are things on the computer that are date sensitive,
so yes, having the date off by a large amount would be
a bad thing.

If you didn't pull the time in sufficiently, perhaps even
this would not work.

https://time.gov/

There is a graphic on the lower-right, showing the time error
between you and a decent-stratum clock at the gov site.

*******

https://kb.netgear.com/20021/Enabling-Wireless-Zero-Config-WZC-on-Windows-XP

https://en.wikipedia.org/wiki/Wireless_Zero_Configuration

"It was later integrated into Windows XP Service Pack 3"

https://www.dlink.com.vn/how-do-i-configure-wpa-psk-on-my-wireless-card-using-the-microsoft-xp-utility-2/

"How do I configure WPA-PSK on my wireless card using the Microsoft XP Utility?

Note: Make sure to have all of the latest Windows Updates.

Step 1 Click on the XP Networking icon to use the Zero Configuration utility.
This will be located in the lower-right corner (system tray). In the
lower-left of the window, click on the Advanced button.

Step 2 Ensure that Use Windows to configure my wireless network settings
is checked. Highlight the network you wish to connect to and click
on the Configure button.

Step 3 From the Network Authentication drop-down, select WPA-PSK. Under
Data Encryption, select TKIP or AES. Enter your Network key and
enter it again next to Confirm network key.
"

This implies some level of support in WZC, at a first glance.
I bet the hardware plays a part too though. At least some
of the crypto had a hardware component. Or so it was claimed
in a past time.

With WZC turned off, it may be up to the proprietary driver to
provide config panels. With WZC on, who knows, sometimes the
stuff just works.

I have no Wifi to speak of here, just the one laptop with a Wifi
on it. Nothing else, no Wifi router, to experiment with. I do
more BT-send than Wifi :-)

Paul

On Mon, 15 Nov 2021 12:46:08 +0100, Lawrence Aracabia
<LawrenceAracabia@Aracabia.com> wrote:

>Mayayana <mayayana@invalid.nospam> wrote:
>
>> I'm using Firefox 52.9 and New Moon 28.10.
>
>I tried Firefox and it still wouldn't connect to httpS web sites.
>
>There seems to be a problem with old "certificates" as only http sites
>work. The laptop had not been used in probably 10 or 15 years.
>
>Is there a way to "check" & "update" the certificates for any given
>browser?

Larger sites seem to update their certificates, but many smaller sites
do not.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

"Lawrence Aracabia" <LawrenceAracabia@Aracabia.com> wrote

| Overall, were all my web problems only related to the date or to the
certificates?

I'm not sure about that. I just remember the certificate update
being possible and I figured it couldn't hurt to update them. The
date problem is something that never occurred to me.

| And, how do I get the option for WPA2-PSK encryption in Windows XP SP3?

I'm afraid that's something I don't remember. I look into
the encryption issues when I buy a new router and then
I promptly forget the whole thing. I find that the older I get,
the less room there is in my mind to store such information.
I don't know, offhand, what encryption I'm using, but I've
never had problems.

On Mon, 15 Nov 2021 at 08:26:48, Mayayana <mayayana@invalid.nospam>
wrote (my responses usually follow points raised):
>"Lawrence Aracabia" <LawrenceAracabia@Aracabia.com> wrote
>
>| I tried Firefox and it still wouldn't connect to httpS web sites.
>|
>| There seems to be a problem with old "certificates" as only http sites
>| work. The laptop had not been used in probably 10 or 15 years.
>|
>| Is there a way to "check" & "update" the certificates for any given
>| browser?
>
>I updated mine according to this webpage:
>
>https://msfn.org/board/topic/175170-root-certificates-and-revoked-certif
>icates-for-windows-xp/
[]
Will that help with a very old Firefox running on W7? I get quite a lot
of cases where I have to accept the exception (or something like that)
but then it works; in (I think it is) the last week or two, I've had a
few that just won't connect, and don't give me the option to override
the warning.

(I ask because it looks as if it's for Windows rather than Firefox, and
I've heard Firefox uses its own independent certificate store [if that's
the right term].)
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

We shall never - never! - allow foreigners to run our economy. They might cure
it. (George Mikes, "How to be Decadent" [1977].)

On Wed, 17 Nov 2021 21:31:20 +0000, "J. P. Gilliver (John)"
<G6JPG@255soft.uk> wrote:

>Will that help with a very old Firefox running on W7? I get quite a lot
>of cases where I have to accept the exception (or something like that)
>but then it works; in (I think it is) the last week or two, I've had a
>few that just won't connect, and don't give me the option to override
>the warning.
>
>(I ask because it looks as if it's for Windows rather than Firefox, and
>I've heard Firefox uses its own independent certificate store [if that's
>the right term].)

Yes, I use three browsers with Windows XP. Opera connects to Twitter,
Firefox doesn't. I use Maxthon for FamilySearch, but it keeps warning
me that Avast has blocked access to a subsidiary site because of an
expired certificate. But Maxthon seems to have DNS trouble. I also use
an older version of Frirefox (v41) but it fails to connect to some
sites too.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

On Thu, 18 Nov 2021 at 05:53:36, Steve Hayes <hayesstw@telkomsa.net>
wrote (my responses usually follow points raised):
>On Wed, 17 Nov 2021 21:31:20 +0000, "J. P. Gilliver (John)"
><G6JPG@255soft.uk> wrote:
>
>>Will that help with a very old Firefox running on W7? I get quite a lot
[]
>>(I ask because it looks as if it's for Windows rather than Firefox, and
[]
>Yes, I use three browsers with Windows XP. Opera connects to Twitter,
>Firefox doesn't. I use Maxthon for FamilySearch, but it keeps warning
[]
So _will_ the suggested method work for old-F-on-W7?
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

One of my tricks as an armchair futurist is to "predict" things that are
already happening and watch people tell me it will never happen.
Scott Adams, 2015-3-9

On Thu, 18 Nov 2021 06:23:27 +0000, "J. P. Gilliver (John)"
<G6JPG@255soft.uk> wrote:

>On Thu, 18 Nov 2021 at 05:53:36, Steve Hayes <hayesstw@telkomsa.net>
>wrote (my responses usually follow points raised):
>>On Wed, 17 Nov 2021 21:31:20 +0000, "J. P. Gilliver (John)"
>><G6JPG@255soft.uk> wrote:
>>
>>>Will that help with a very old Firefox running on W7? I get quite a lot
>[]
>>>(I ask because it looks as if it's for Windows rather than Firefox, and
>[]
>>Yes, I use three browsers with Windows XP. Opera connects to Twitter,
>>Firefox doesn't. I use Maxthon for FamilySearch, but it keeps warning
>[]
>So _will_ the suggested method work for old-F-on-W7?

I think the site owner has to update the certificates.

If your laptop is using W7 you can probably update Firefox, but you
might run into problems because of software bloat -- each update of a
priogram seems to require more memory than the last, and nowadays I
often go and make coffee while waiting for a web site to CLOSE.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

"J. P. Gilliver (John)" <G6JPG@255soft.uk> wrote

| >I updated mine according to this webpage:
| >
| >https://msfn.org/board/topic/175170-root-certificates-and-revoked-certif
| >icates-for-windows-xp/
| []
| Will that help with a very old Firefox running on W7? I get quite a lot
| of cases where I have to accept the exception (or something like that)
| but then it works; in (I think it is) the last week or two, I've had a
| few that just won't connect, and don't give me the option to override
| the warning.
| | (I ask because it looks as if it's for Windows rather than Firefox, and
| I've heard Firefox uses its own independent certificate store [if that's
| the right term].)

I can't answer that. I came across the cert issue at one point
and did the update. But personally I've never had the problem
of widespread cert rejection that some people talk about.
(FF 52 and New Moon 28) Did the cert update help? I'm afraid I
just don't know. You may be correct that only IE, winhttp, wininet,
and various other system Internet functionality can benefit.

Like you I sometimes get the warnings. There's another trick that
I don't remember offhand to make sure that you get the option
to override. (Firefox gets more daffy all the time.) But you should see
the reason for the warning in that page, too. It's almost always one
of two things:
1) The cert recently expired and hasn't been updated. 2) The cert
is someone else's. In the second case the problem is usually that
MarysMassage.com or EdsHuntingMemorabilia.com are hosted on
CheapHosting.com and their cert is registered to CheapHosting.com,
because getting your own cert is complicated. Firefox then sees
that as a suspicious cert.

Does any of this matter? Not really. If you're going to type in a
credit card number it's important. If you're going to look at photos
of Ed's antique guns then the only risk is that a man in the middle
hack could see the content of the webpage you're visiting. As they
say sometimes in the US but probably not in Britain: Big whoop!

"J. P. Gilliver (John)" wrote:
> On Mon, 15 Nov 2021 at 08:26:48, Mayayana wrote:
>>I updated mine according to this webpage:
>>
>><https://msfn.org/board/topic/175170-root-certificates-and-revoked-certificates-for-windows-xp/>
> []
> Will that help with a very old Firefox running on W7?

No. FF has its own cert store.

> I get quite a lot of cases where I have to accept the exception (or
> something like that) but then it works; in (I think it is) the last
> week or two, I've had a few that just won't connect, and don't give
> me the option to override the warning.

Depending on how old your FF is, it may not support the encryption
algorithm the site wants to use. No amount of updated certs will help
with that and FF won't be able to override. It might be useful if you
could note here which URLs are giving trouble and what version of FF
you're using.

"Apd" <not@all.invalid> wrote

| Depending on how old your FF is, it may not support the encryption
| algorithm the site wants to use.

Why do you think that? TLS 1.3 was added in FF 49. In 52.9
I have security.tls.version.max set to 4 and fallback-limit set
to 3. 1.3 was new 2 years ago. I'm not aware of any TLS 1.4.
Even when the latest isn't supported, sites should use the next
one down. Some sites won't support 1.1, for example.

(The settings add 1 to the level because 1.0 is 1. So 1.2
is 3 and 1.3 is 4.)

I seem to remember that some people were using things like
FF 28. But that still supports 1.2. Anyone who thinks they may have
trouble can check about:config to make sure they're running at
full capacity.

"Mayayana" wrote:
> "Apd" wrote:
>| Depending on how old your FF is, it may not support the encryption
>| algorithm the site wants to use.
>
> Why do you think that?

It's another thing to consider. Each TLS version specifies various
cyphers (cypher suite) that can be used. I don't know what obligation
a server has in the way of full support for all in any given TLS
version or if a browser would implement them all. Perhaps someone can
clarify. I know I've had the odd message that a particular cypher
was not understood (may not have been Firefox).

https://en.wikipedia.org/wiki/Cipher_suite

> TLS 1.3 was added in FF 49. In 52.9
> I have security.tls.version.max set to 4 and fallback-limit set
> to 3. 1.3 was new 2 years ago. I'm not aware of any TLS 1.4.
> Even when the latest isn't supported, sites should use the next
> one down. Some sites won't support 1.1, for example.

Exactly.

> (The settings add 1 to the level because 1.0 is 1. So 1.2
> is 3 and 1.3 is 4.)

The default in FF 52.9 is 3 so I wonder if 1.3 is fully supported.

> I seem to remember that some people were using things like
> FF 28. But that still supports 1.2. Anyone who thinks they may have
> trouble can check about:config to make sure they're running at
> full capacity.

I believe JPG is/was using a very old ver of FF.

"Apd" <not@all.invalid> wrote

|
| > (The settings add 1 to the level because 1.0 is 1. So 1.2
| > is 3 and 1.3 is 4.)
| | The default in FF 52.9 is 3 so I wonder if 1.3 is fully supported.

Look it up. FF 49. The reason it defaults to 3 (TLS 1.2)
is because 4 (1.3) is fairly new and may not be supported
everywhere. The browser is supposed to do a "handshake",
offering what versions it supports, then the server picks the
highest that it supports. So there shouldn't be any problems.
Except possibly with assholes like Google who love to tell you
last week's browser is not sufficient.

Anyone using FF 52 should set the default to 4 (TLS 1.3)
and the fallback to 3. Then all sites should be able to
handle it.

"Mayayana" wrote:
> "Apd" wrote
>| The default in FF 52.9 is 3 so I wonder if 1.3 is fully supported.
>
> Look it up. FF 49.

I have, and before FF 63 they were draft versions. Bugzilla mentioned
some compatability issues but stated "It's fairly safe to flip the
pref if you know what to expect".

> Anyone using FF 52 should set the default to 4 (TLS 1.3)
> and the fallback to 3. Then all sites should be able to
> handle it.

I take it you haven't had problems so I'll try it.

On Fri, 19 Nov 2021 16:17:49 -0000, "Apd" <not@all.invalid> wrote:

>Depending on how old your FF is, it may not support the encryption
>algorithm the site wants to use. No amount of updated certs will help
>with that and FF won't be able to override. It might be useful if you
>could note here which URLs are giving trouble and what version of FF
>you're using.

One that none of my browsers will override is

http://www.oca.org

Firefox reports an expired certificate, and won't override.

Maxthon reports that Avast has blocked it.

Opera does something similar.

Firefox 41 still gets me into Google & Wordpress, and most pages of
GoodReads, other than book description pages, which won't display
properly.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk