HTTPS-connection is not working with Windows XP guest

[bandi88]

Hello,

I am using the VMWare Player 12.5.2 build-4638234 on my Debian Linux 8.x host.

I have a Windows XP (with SP3) guest VM, where firewall is disabled. Network connection is set to NAT.

The problem is: I can access internet on HTTP-port (80) without problem (e.G. google works), but I can't acces any HTTPS internet sites.

Can You please help me to resolve this issue?

Thanks in advance.

A. V.

[wila]

Hi,

You're not saying it, but I'm guessing you are trying to access https websites using Internet Explorer?

The certificates that comes with Windows XP are too old. Try installing either chrome or Firefox, although both might have dropped Windows XP to browse the internet.

Quite frankly connecting a VM running Windows XP to the internet is a bad idea.

The OS is so far out of official support that there's a ton of ways to get infected.

Unless that is your goal, I'd say don't do that.

No antivirus will be able to protect that anymore.

Windows XP was great and can be useful for a number of things, but it does not include connecting it to a network (or worse internet).

--

Wil

[bandi88]

Dear Will,

I would not use the WinXP if I had another choice. But there is a special Windows software which is not running anymore from Windows Vista and above.

Therefore I am forced to use it.

And the problem is: this special software builds up a https-connection to get some data. So, I have to find the solution.

What happens if I install the newest firefox or chrome?

A.

[wila]

Hello A,

Ouch, then I'm afraid I do not have good news.

No installing Firefox or Google Chrome will not help for that, at all.

Without more information (I would need to see the actual https connection to be sure) it sounds like the global depreciation on SHA-1 for certificates is your problem.

See also:

Is Your Organization Using SHA-1 SSL Certificates? | Security content from Windows IT Pro

Down there you can read that Windows XP SP3 has support up to SHA-2.

If your Windows XP is up to date then that -in theory- should still work. But of course I don't know how the https connection is setup.

There's plenty of antivirus products that meddle with https connections and they could break this easily, so while I'm not in favor of getting rid of antivirus on Windows XP guests, it could be a worthwhile troubleshooting step (uninstall not just disable to make sure)

If that still does not help then I'm afraid getting the software to work on Vista (or higher) is your best bet.

As long as there are no hardware drivers involved that usually is do-able. Most software works ok, once you run it via the compatibility modes that Vista (and higher) offer.

In that case, right click the application icon in the start menu, select properties, then on the "Compatibility" tab set the compatibility level to Windows XP.

If there's a problem getting it installed you can try the same for the installer. If that still doesn't work... there's another way. Upgrade Windows XP to Vista.

As always make a backup of your virtual machine before trying something like this so that you have a good copy to start from if something fails.

--

Wil

[bandi88]

Dear Will,

getting to Windows Vista or above is no option to me (I tried it previously).

So, the only possibility to get my important(!) software to work, is to use the WinXP.

Can you help me, what and where should I check? You wrote: "I would need to see the actual https connection to be sure". What infos and where can I get to let it be analyzed?

Thanks.

A.

[wila]

Hi,

The actual URL being accessed or a tcp packet dump would be needed in order to figure out the actual SSL/TLS that is being negotiated.

--

Wil

[bandi88]

Hi Will,

I made a tcp packet dump by using wireshark. Can You please help me find out the possible source of problem?

Thanks in advance.

Regards,

A.

[wila]

Hi,

Not seeing anything very wrong in the TLS handshake itself. The server proposes TLSv1.0 which is not an issue for Windows XP and the handshake itself appears to complete OK.

Now I might be overlooking something as I do not look at packet dumps often.

So as the packetdump contains enough info for me to connect to the server directly I figured to try a test via openssl.

There I DO get an error.

$ openssl s_client -showcerts -connect yourip:443
CONNECTED(00000003)
depth=1 /C=US/O=GeoTrust Inc./CN=GeoTrust SSL CA - G2
verify error:num=20:unable to get local issuer certificate
verify return:0

The above means that it is missing a root certificate. It might help installing that certificate in your Windows XP if you do not control the server (1)

So then I ran that same site through Qualys ssl labs.. umm.. plenty of work to do on that config.

https://www.ssllabs.com

Not sure if you control the site, but if you do, have a look. I'm not posting the URL here now as I don't want a search engine to pick it up.

The "good" news is that the server uses a SHA1 certificate, good as in that your Windows XP won't choke on that.

However the certificate used on the main site (not on the subdomain) should work too.

(1) the root certificate that your windows XP should have -perhaps already has- is: GeoTrust Global CA

--

Wil

[bandi88]

Will,

The website is not mine, so I cannot do anything with it. It is the server location of the location of the developer, I would like to use.

However, if I am trying another https, I get the same error (for a completly other server and software and IP address). As attachment You see the results of this another https-connection.

Another strange issue: if I try to open any https website using the browser (Internet Explorer 8), then I get a certificate error (untrusted site) for EVERY https-website, regardless on the url. The error message is like that: http://magma.maths.usyd.edu.au/images/faq/win7certs_ie8_13.png

Can You please let me know the next step to resolve this issue?

Thanks for Your help.

A.

[wila]

Hi,

OK, the screenshot talks about not having the correct root certificate in your trusted CA store.

So either missing or expired.

This might help:

https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_cmautorootupdt.m...

Otherwise look through the possible updates (not only the required ones) in Windows Update and run anything that talks about (root) certificate updates.

There have been several updates in that area.

--
Wil

[bandi88]

Hi Will,

Thanks for the assistance. I updated the root certificates manually from Trustwave® SSL - Support - Root Download Links, now some https-websites are already working. The certificate error message seems to be gone.

However, many of them still not works. Example: https://ebooks.eccouncil.org/ (packet dump also attached)

Strange fact: every https-sites, which are not working, the internet explorer say: "page cannot be displayed", as here: https://i.stack.imgur.com/KjvaS.png

So, certificate error message is gone, but many https websites are somehow still unreachable under my WinXP.

Can You please help, why some https-websites still not work?

Cheers,

A.

Re: HTTPS-connection is not working with Windows XP guest

[wila]

Hi,

I think now we are back to "you shouldn't browse the web with Windows XP"

Actually you can try and check for your self too. On ssllabs.com there's an option to test servers, but also for testing your browser.

It will show the protocols your browser supports.

If you put the host for the site you asked into the ssllabs site then it lists that Windows XP is not supported and that the connection was closed when tried.

The site is not supporting Windows XP and I can't really blame them as it is a huge pain to support older browsers.

You can still try Chrome or Firefox or ... and while that might work, it still falls under the "bad idea" factor.

Just use the VM for your important application and nothing else as infecting your VM and heaven knows what else is not helping to keep your app alive.

--

Wil

[bandi88]

Dear Wil,

The application, I have to use, needs to establish a https-connection.

I attach the negotiation, what the application does, the packet dump of it.

Please let me know what goes bad with this. It is very important to get this application running, and under that VM.

Thanks for help.

A.

[wila]

Hi,

Yes I looked at it, it is the eccouncils.org site again.

Sorry won't work and as far as I understand it, this cannot be fixed in Windows XP as it is effectively blocked.

--

Wil