Hacker News Reader

I installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.

View on HN

Firefox uses its own certificate store, that's why it works on Windows XP. Chrome and Internet Explorer will likely not work, because they use Windows XP's certificates, which don't include trust for Let's Encrypt.

Their root certificate is currently not trusted by any browser vendor. They have a cross-sign from IdenTrust, which is trusted even by XP. However, their intermediate certificate uses a name constraint in a way that causes schannel (Microsoft's TLS stack) on XP to think they're not allowed to issue certificates for any domain name. Chrome and IE use schannel, while Firefox ships its own TLS stack. This bug was fixed in newer versions of Windows. This might get fixed if someone finds a way to generate an intermediate cert that doesn't trigger this bug (while still including the *.mil constraint).

No, Let's Encrypt does not work in either Chrome or IE on Windows XP [1]. This is a known bug with their intermediate certificate [2].

[1] https://github.com/letsencrypt/letsencrypt/issues/1660

[2] https://community.letsencrypt.org/t/help-needed-windows-xp-s...

Reply on news.ycombinator.com