Allows https for ie6 on win2k

[MikeMcQ]

@crt

i cant have http in the sites enabled config

I don't think you quite understand the difference between nginx http context and server blocks.

Please upload the config.txt from this. An UPPER case T is essential

sudo nginx -T >~/config.txt

The config.txt will be in your home directory and be fairly large. You should see just two lines displayed to the console but the entire active nginx config in that .txt file

[9peppe]

Wait, if it's just your windows xp/2000 machines instead of all windows xp/2000 machines... why not use your private certificate authority with whatever config you want?

(It will reintroduce several vulnerabilities, but you can probably adopt reasonable countermeasures)

[Patryk]

@MikeMcQ

Your domain proxied at Cloudflare requires SNI. If the browser client does not support it that won't work.

Correct. By default, all domains on Cloudflare require SNI. If needed, non-SNI support can be enabled by contacting Enterprise Sales.

@MikeMcQ

Your forum.redtro.net domain is proxied at Cloudflare and allows TLS 1.0 and TLS 1.1. But, it is using an ECDSA cert and related ciphers. I don't know how to force their edge to use an RSA cert. That may be a better question for the Cloudflare community forum.

RSA certificate will be issued automatically with any paid plan, then the edge will respond with ECDSA or RSA depending on capabilities of the client.

Certificate authorities

Still, created certificate will be SHA-2. If SHA-1 is needed, you can upload a custom certificate with Business plan. Since you can't get a publicly-trusted SHA-1 certificate any more, this becomes a private CA.

[crt]

contacting enterprise sales sounds expensive, something i cant afford
i think im just gonna stick with http then.

[Patryk]

Hehe, yeah. You have a very niche problem.

Your options are:

• some commercial CAs might still be able to issue "legacy certificates" from their old roots that have been pulled from trust stores (but still present in old operating systems; they don't need to follow rules any more), this is going to cost you $$ though, and unsure whether this practice has stopped already
• create a private CA, and ask users to import it into their systems
• use modern computers sitting on a side to discuss vintage computers
• just use HTTP

[griffin]

@Patryk

just use HTTP

Try to avoid that if at all possible!

[Patryk]

indeed!

[MikeMcQ]

@crt

i think im just gonna stick with http then.

Did you ever sort out why your nginx didn't connect using TLS 1.0 or 1.1

I am pretty sure it is because your HTTP context or default server block did not allow it as I noted earlier. A single server block cannot override those except in very unusual situations which yours is not.

[crt]

Please upload the config.txt from this. An UPPER case T is essential
sudo nginx -T >~/config.txt

do i paste it here or is there some sort of dm function? i dont think its smart putting every endpoint and all the settings here out in the open maybe

[9peppe]

Can a proxy on a modern machine strip TLS and offer http websites to the old machine?

[crt]

mr griffin im afraid thats the only alternative, as i suppose leaking the backend ip is gonna cause a lot more issues, like direct access to the vps ip and allowing ddos. contabo's protection is just some guy in the server room unplugging the ethernet as far as im aware ;w;'