So there was at least a chance it would work.

MbedTLS.dll does support ECC, however, which is why I suggested the ReactOS schannel.dll: it was originally the Wine version of schannel.dll but was rewritten use MbedTLS.dll for its cryptography functions. (To see what will and won't connect to, you can go to and enter Takes a few minutes to run all the tests.) The only cipher suites supported by use elliptic curve cryptography for key exchange, and stock XP doesn't support ECC. supports TLS 1.0, and according to it will connect using TLS 1.0 to IE 7 (!) on Vista. Apparently that site does support one cipher suite which is compatible with TLS 1.0, so I no longer think TLS 1.2 will help connect to it.Īnd reports that even Chrome 49 won't connect to that site on XP.

It's true that the problem connecting to isn't TLS 1.2. The actual problem is the Windows XP no ECC certificates can be administrated or not registered and these are recognized as invalid. The problem is not TLS 1.2, which is supported on Google Chrome, as well as ECC certificates. Off-topic rant : why are ECC-based certs seemingly gaining wider use ? Of course they sport smaller key-lengths, but ISTM their security against progress in cryptanalysis is even less assured than RSA, whose mathematics are much better understood.Īdded remark/question about ECC crypto and XP-SP3 isn't native support for ECC crypto one of the touted addidtions in XP-SP3 ? I guess it's more subtle than support versus no-support, the issue may be one of incomplete/buggy support for some flavor of ECC. This was certainly true of XP until SP2, but. In addition, what Heinoganda said and you quoted here is in doubt:«The actual problem is the Windows XP no ECC certificates can be administrated or not registered and these are recognized as invalid.»

The OP even asserted Firefox on XP does support the otherwise offending certs - which you decided to ignore :=) The question is whether it's possible to fix XP's native crypto libraries in order to accept the ECC (or whatever fancy) certs, not whether non-native crypto such as in Qtweb, Opera-Presto support them.

Which was what the OP was told initially, but decided to ignore.

Avast blocking sites with valid certs