Re:Early Impacts of Let's Encrypt
by heinrich5991 on Sunday February 21, 2016 @06:19AM
(#11144088)
Firefox uses its own certificate store, that's why it works on Windows XP. Chrome and Internet Explorer will likely not work, because they use Windows XP's certificates, which don't include trust for Let's Encrypt.
[ Parent
| on HN ]
Their root certificate is currently not trusted by any browser vendor. They have a cross-sign from IdenTrust, which is trusted even by XP. However, their intermediate certificate uses a name constraint in a way that causes schannel (Microsoft's TLS stack) on XP to think they're not allowed to issue certificates for any domain name. Chrome and IE use schannel, while Firefox ships its own TLS stack. This bug was fixed in newer versions of Windows. This might get fixed if someone finds a way to generate an intermediate cert that doesn't trigger this bug (while still including the *.mil constraint).