I've had some interactions with Pat David but still get the following (and cannot subsequently access the site). I've checked and even tried to do some things to bypass, but to no avail. I can use Edge to access the site, but rather stick with using my Sandbox (XP VM).

Site (where G'MIC is discussed): https://discuss.pixls.us

Works for me with both Firefox and Chromium.

Likely Pixls is using a certificate from an Authority for which you have no installed certificate. One way around this is to install Pixls certificate in your XP browser.

Attached the cert issues. All prime and sub certs are fine. Only one that's giving me a head-ache is the one in-between (Let's Encrypt Authority). Very strange. I tried clearing all my certs and everything (originally just the cookies and certs) per my conversations with Pat but to no avail. Weird. I am using Iron Browser and it may indeed be an issue with Iron since Chrome is working fine (based on your input).

Below's the cert itself (other tabs say things are hunky dory).

While noticing it's DNS related, I temporarily disabled OpenDNS to see if that was causing the issue, but it was not. Still perplexed. Temporarily installed Opera browser and had no issue getting the pixl's site so it's isolated to my Iron Browser. I might try later to complete un-install Iron and re-install it, but would prefer not to do this.

Not sure what it could be, but I did try to bypass the DNS and use Pixls direct ip and get the following error:



If someone can go to the command prompt and do a ping for me for pixls.us to see if 199.96.156.125 is the correct IP, I would appreciate that. I did install privacy badger (got it from website that was linked from Cameleon's website) and it may be the issue. I did bypass privacy badger but still get these issues.

From lookup
SourceTTLAddress TypeRecord TypeResolution
pixls.us.86381INA199.96.156.125

Thanks Odin. There's a gremlin in Iron that's blocking me based on a perceived rogue cert. I will just have to use Opera to access Pixls for now. Don't go that often (though I feel guilty about that; lol), but when I do, at least I have a work-a-round that still works withing my XP sandbox.

So I looked into this based in problems another iron browser user was having on winxp...

https://plus.google.com/+PatrickDavid/p ... 1&hl=en-US

Long story short, Windows XP is past End-of-Life, so the crypto API's are woefully out of date. (Cannot handle SHA256 signed certs, doesn't support SNI, and has problems with certs that have namespace restrictions).

I'm glad (though a little surprised) that at least you found a browser that you can use as a workaround - though honestly why not sandbox with a modern Linux instead of XP?

I'm also sorry for the problems. I have to make a decision between weakening security to accommodate an old OS, or drop support for it to support stronger security.

XP is my crutch and I like running multiple Sandboxie sessions within my XP VM (double-sandboxed for each session). There is no Sandboxie equivalent for Ubuntu which would mean I would have to delete my VMs (recover from gold point) more often and I don't like to do that (try to keep my VMs for a week or two before I do the golden recovery point flow). So it now appears to be an XP issue with crypto-hashing, aye? Would be cool if someone would come up with a patch for XP users, but I know XP's life is limiting to say the least. lol

Thanks for that extra info Pat. Again, I do have a work-a-round until it becomes an issue with Opera.

I am looking into possibly handling XP users with a redirect to the non-https version of the site in my config files, but it's really low priority and may not happen at all (particularly for discuss - which is much harder to pull this off with).

My understanding is that Letsencrypt will not work with IE on XP because the browser does not support SNI.

Don't do this for me, Pat since I can use a work-around. If others cannot, then I suppose it would be good for them. Appreciate, again, your answer to me about this.