Hacker News Reader

Comment by forlorn | Hacker News Reader

It doesnt support browsers in Windows XP and it is the only annoying thing which forced me to rollback letsencrypt. I know it is 2016 but complaining clients is not what you want anyway.

I still have no idea if they are able to fix this in future.

View on HN

I installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.

Firefox uses its own certificate store, that's why it works on Windows XP. Chrome and Internet Explorer will likely not work, because they use Windows XP's certificates, which don't include trust for Let's Encrypt.

Their root certificate is currently not trusted by any browser vendor. They have a cross-sign from IdenTrust, which is trusted even by XP. However, their intermediate certificate uses a name constraint in a way that causes schannel (Microsoft's TLS stack) on XP to think they're not allowed to issue certificates for any domain name. Chrome and IE use schannel, while Firefox ships its own TLS stack. This bug was fixed in newer versions of Windows. This might get fixed if someone finds a way to generate an intermediate cert that doesn't trigger this bug (while still including the *.mil constraint).

No, Let's Encrypt does not work in either Chrome or IE on Windows XP [1]. This is a known bug with their intermediate certificate [2].

[1] https://github.com/letsencrypt/letsencrypt/issues/1660

[2] https://community.letsencrypt.org/t/help-needed-windows-xp-s...

Reply on news.ycombinator.com