2

I have an old Debian 5 (Lenny) machine, and by default it has the Iceweasel internet browser. Whenever I attempt to access an HTTPS site, the browser throws an SSL error saying that it cannot be established. SSL/TLS v.1.2 has been around since 2008, and the final release of Debian 5 came out around 2009. I know that my hardware is able to make HTTPS connections when using a more recent version of Debian, but with this old Debian 5 machine, there are no available modern web browsers I can install to replace Iceweasel. Is this a browser issue, or an OS issue?

3
  • 5
    AFAIK, protocols older than TLS 1.2 had been deprecated; if the browser tries to establish a connection with a older protocol and cannot renegotiate, the connection will fail, even if there is support for TLS 1.2 in the browser.
    – Leo B.
    Aug 30, 2017 at 16:48
  • 2
    Also the certificate store is obsolete, the only way I can connect to https/ssl websites with my lenny install is to force a no check certificates. You may be able to get around this issue by manually installing either firefox or chrome from upstream sources, chrome only supports 64 bit however as of a year or two ago. But you can easily run firefox from the direct moxilla tar.gz package, it's easy to install, just put it in /opt/firefox then update your paths. No apt installed browser is going to work as far as I know, but you don't need it to be installed by apt, I use mozilla direct install
    – Lizardx
    Aug 31, 2017 at 0:59
  • What version of iceweasel are you running? You might be able to change the supported TLS versions in about:config
    – cherdt
    Aug 31, 2017 at 21:50

1 Answer 1

3

The problem is that your operating system generally supports TLS up to version 1.0, but this is 2017 and a large part of the Internet now requires TLS 1.2. Although the TLS 1.2 specification came out in 2008, it wasn't widely adopted until much later. For example Firefox only supports TLS 1.2 since version 24 which came out in 2013. Chrome supports TLS1.2 since version 29 which came out the same year. The OpenSSL library, which most “lesser” browsers use, has only supported TLS 1.2 since version 1.0.1 in 2012.

Even with sites that still support TLS 1.0, you may have to click through invalid certificate warnings because the set of root certificate authorities has changed over time. And keep in mind that the reason older protocol versions are deprecated is that they have security flaws.

If you want to access HTTPS websites from your machine, you can use a man-in-the-middle proxy on a more modern system. Beware that a man-in-the-middle proxy works against the security properties offered by HTTPS, so it's difficult to use one securely. Don't transmit any confidential information this way. See Is it possible to utilize an outbound proxy to upgrade to TLS or Proxy server accepting TLS 1.0 and calling TLS 1.2 downstream for some software suggestions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.