IE9: Last Supported Browser for Vista

[Vistaar]

Browser support for Windows Vista is almost nonexistent now - or is it? If they wish to continue thumbing their noses at Microsoft, power users can turn IE9 into a veritable Stegosaurus: well-protected, but still a lumbering dinosaur. Three months after Microsoft ended support for Vista, they issued an Update to add support for TLS 1.1 and TLS 1.2 in Windows Server 2008 SP2, the server version of Vista which is still under extended support until January 2020. Before long, an MSFN member with screen name VistaLover posted instructions on Enabling TLS 1.1/1.2 support in Vista's Internet Explorer 9. Of course every browser nowadays supports at least TLS 1.1 and 1.2, if not 1.3 - but versions old enough to work on Vista are no longer receiving security updates, whereas Microsoft is still issuing cumulative updates for IE9 for the benefit of Server 2008 users. Note: VistaLover suggests installing all updates intended for Server 2008 since support for Vista ended before you begin - an idea that I don't necessarily endorse - but all that is really necessary for this purpose is to install the latest Server 2008 cumulative update for IE9 from Microsoft Update Catalog. Update: If you did not install sha2 support in 2019, be advised that the last cumulative update with an sha1 signature was KB4507434.

For the second time in less than a year, MSFN was recently down for about a week. During that time, the thought occurred to me that if MSFN was indeed gone forever, VistaLover's instructions might also be lost - particularly the necessary registry edits. So with full credit to VistaLover, I will quote the instructions here:

1. Install then KB4019276

2. Reboot the Vista machine

3. After restart, launch the Registry Editor (regedit), preferably as Administrator.

4. Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.1

5. Delete the "OSVersion"="3.6.1.0.0" subkey; BTW, I don't know which WinOS that string refers to (Win6.1=Win7)

6. Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.2

7. Again, delete the "OSVersion"="3.6.1.0.0" subkey. Exit Registry Editor.

After that, you just need to change settings in Internet Options > Advanced tab under Security.

Update: KB4019276 has been superseded by KB4056564, so I would suggest using the newer update instead.

Vista x64 only: 64-bit Vista systems require two more registry edits that VistaLover (running x86) was evidently not aware of:

4b. Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.1

5b. Delete the "OSVersion"="3.6.1.0.0" subkey.

6b. Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.2

7b. Again, delete the "OSVersion"="3.6.1.0.0" subkey.

(Thanks to wither 3 for elucidating a rather cryptic MSFN post.)

If the link to VistaLover's post at MSFN given above ever fails, the page is archived at Enabling TLS 1.1/1.2 support in Vista's Internet Explorer 9. I recommend that you familiarize yourself with it before attempting these instructions. There was also some discussion at Bleeping Computer beginning here. Keep in mind that IE9 will still be a seven-year-old browser that is no longer supported by many websites. Good luck!

 

[Vistaar]

I do not endorse any of the unnecessary registry changes discussed below - only those recommended by VistaLover above.

 

[wither 3]

This wasn't as straight forward as it seems.

I did the installation of the 2008 file and the registry changes. I then rebooted. When I went to the IE settings, the TSL 1.1 and TSL 1.2 options weren't there. I only had the SSL options and TSL 1.0.

So, I went to the Microsoft help via the link provided. Since I didn't want TSL 1.1, I'll quote the help for TSL 1.2-

"TLS 1.2

This subkey controls the use of TLS 1.2.

Note For TLS 1.2 to be enabled and negotiated, you must create the DisabledByDefault DWORD entry in the appropriate subkey (Client, Server), and then change the DWORD value to 0.

By default, this entry does not exist in the registry.

Registry path

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2

To disable the TLS 1.2 protocol, you must create the Enabled DWORD entry in the appropriate subkey, and then change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 1.

By default, this entry does not exist in the registry."

Kind of convoluted because it says that to enable or disable TSL 1.2, you must set the value to "0."

So I went to that entry and the only thing there was the SSL with a subkey of Client.

So I created a new entry for TSL 1.2 with the Client subkey and made the above changes (I used a value of "1.") When I then went to the IE settings, there was no TSL 1.2. I rebooted and it didn't change anything.

Since it says (Client, Server) above, I went back to the registry and edited the new TSL 1.2 entry to add the Server subkey to the Client subkey and put in the same values which were previously in Client. Same result in IE settings, even after rebooting.

I wondered why the TSL 1.0 was in the IE settings so I searched the registry for it and found this key-

HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

It said to Use TSL 1.0. so, I changed it to TSL 1.2. That deleted the TSL 1.0 setting from the IE settings and replaced it with TSL 1.2.

I don't know if I have to make any other changes. The thing that bothers me is that the Default Value in this key-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.2

is set to (0).

The question I have is- Will Windows Update pick up new changes to the Server 2008 security settings?

 

[Vistaar]

I did the installation of the 2008 file and the registry changes. I then rebooted. When I went to the IE settings, the TSL 1.1 and TSL 1.2 options weren't there. I only had the SSL options and TSL 1.0....

The question I have is- Will Windows Update pick up new changes to the Server 2008 security settings?

Hello wither 3, I'm glad somebody gave this a try. Before installing KB4019276 and editing the registry, did you update IE9 with the latest cumulative update intended for Server 2008 as I suggested in post #1?

Windows Update will never give Vista any updates intended for Server 2008, if that is your question.

 

[wither 3]

I didn't install anything before the KB4019276. I went looking at the first reference in your first post and, if you don't read carefully, you'll miss that it sends you to another site for installing other parts of 2008. It is super confusing. In all, it's stated that the 4019276 is the most important update (like the others don't really matter). I should note that my IE 9 version is 9.0.90 which is higher than the final update provided by Microsoft before ending support.

Now you got me thinking. I don't think I installed the the 11/10/2017 version of the above KB. Not sure if it matters. The last update I installed was the KB4230450.

Well, I had 2 questions. The first is about the default for the TSL 2 in the Crypto key.

You answered my second question. You're saying that I have to go to the Microsoft Catalog periodically and look for updates.

Update: I just tried to download the 11/10/2017 version of the KB and Vista insists on downloading it as a .ms file, rather than a .msu. Didn't have that problem with the others.

 

[wither 3]

Still haven't figured this out. I have TLS1.2 enabled per the instructions. However, if I go to something like Pandora, it says my browser is out of date. I don't know if it uses TLS1.2.

I haven't been able to get TLS1.1 back in use (Only TLS1.0 was previously listed but, now it's gone, because I enable TLS1.2). I changed my registry settings similar to those in Win 7 for TLS1.1. What I can't do in the registry is make the change to "use TLS1.1." I tried to do it similar to what's in Win 7 but was unsuccessful.

 

[townsbg]

Websites can be programed to recognize the browser version number and not just the TLS version.

 

[wither 3]

Thanks, I always appreciate your input. However, how does that help? Seems that the MSFN website is always down so I can't create an account so that I can ask VistaLover about this whole thing. I've been very careful about not doing anything in the registry to mess this up. The Vista and Win 7 registries are almost identical, in regards to this. Only minor numbering differences in the C:\System32 folder. In the mean time, I've been using Opera except when I need to get to dropbox. I can get there now with IE 9 and Firefox. I can get to Pandora with Firefox but not IE 9. I can work with Accuradio in Opera and Firefox but, even though it loads, it won't function in IE 9.

 

[Vistaar]

I did the installation of the 2008 file and the registry changes. I then rebooted. When I went to the IE settings, the TSL 1.1 and TSL 1.2 options weren't there. I only had the SSL options and TSL 1.0...

I just noticed in another recent post of yours that you are running Vista x64, unlike VistaLover and I (you should really fill out your Computer specs), Not long ago, I learned that VistaLover's instructions were incomplete for 64-bit systems. Please see this MSFN post. Sorry I wasn't able to solve your problem much sooner. I added an Update to my original post.

 

[wither 3]

I inserted my computer specs.

I'm not concerned about the TSL 1.1 issue but thanks for your help.

 

[Vistaar]

...I don't think I installed the the 11/10/2017 version of the above KB. Not sure if it matters....

I do not know why Microsoft posted KB4019276 on three different dates. I used the original 7/18/2017 x86 version, which was obviously the version used by VistaLover (his instructions having been posted 7/26/2017), and cannot vouch for the others. Extracting with 7-Zip reveals a text file:

ApplicabilityInfo="Windows Vista SP2;Windows Server Core SP2;Windows Server 2008 SP2;"
Applies to="Windows 6.0"
Build Date="2017/06/09"
Company="Microsoft Corporation"
File Version="1"
Installation Type="FULL"
Installer Engine="Component Based Servicing - WUSA.exe"
Installer Version="6.0.0.0"
KB Article Number="4019276"
Language="ALL"
Package Type="Update"
Processor Architecture="x86"
Product Name="Windows 6.0"
Support Link="http://support.microsoft.com?kbid=4019276"

This is what my Internet Properties/Advanced tab looks like (under Security):



Note that I have disabled every protocol that IE9 formerly supported. Perhaps I should also disable TLS 1.1 (I did for my administrator account - not that I can think of any good reason to open a browser while logged in as administrator, but IE9 is probably the most secure browser on my Vista system these days). Lack of support for TLS 1.3 will of course be a growing problem - not that Vista has a bright future in any case. Regarding the supposed security advantages of TLS 1.3, the recent Vista News item New TLS encryption-busting attack also impacts the newer TLS 1.3 makes me rather skeptical.

This is my current Internet Explorer 9 version with Tuesday's update:

 

[wither 3]

Did you leave out a screenshot of your "internet properties, advanced, security" and "This is my current Internet Explorer.............?" Scratch that. For some reason, I can't see them here in the forum but I can see them in the e-mail notification.

I don't have tls 1.2 and the update version you're showing.

By the way, I've updated all the way to December 2018 using updates provided for v2008 which are also applicable to Vista.

 

[Vistaar]

No, I did not leave anything out. Your urgent compulsion to post something probably resulted in excessive haste. If you still can't see the screenshots, start a thread and maybe townsbg could assist you.

Before someone is inspired to post an off-topic question here, I hasten to point out that there is an active thread at MSFN, Server 2008 Updates on Windows Vista. The present thread has a much narrower topic.

If anyone running Vista x64 can confirm that the additional steps mentioned by WinClient5270 (in addition to VistaLover's original steps, which are evidently only sufficient for Vista x86) allowed you to enable TLS 1.1 and 1.2 for IE9, that would be welcome news. The OSVersion registry keys for TLS 1.1 and 1.2 evidently only served to exclude Windows Vista from the benefits of a long-overdue Windows update (note that there is no such key for TLS 1.0).
I would presume that the update worked "out of the box" for Windows Server 2008 SP2; but if you think Vista users are scarce these days, try finding someone running Server 2008...

In case anyone wishes to restore the OSVersion keys but did not back up their registry, they are Type REG_SZ with Data 3.6.1.0.0

 

[wither 3]

As I mentioned in my post, you could "scratch that comment." However, I still can't see those two areas here in the forum. If I run into that problem again, I ask townsbg about it.

I also don't have this key- HKEY_LOCAL_MACHINE>Software>Wow6432Node>CRYPTO
mentioned by WinClient5270.

 

[townsbg]

My VM is 32-bit.

 

[wither 3]

I mentioned I would contact you if I can't see images in other posts because he said that's what to do. I don't know why I can see all his images in the e-mail notification but not in the forum.

 

[Vistaar]

...don't have this key- HKEY_LOCAL_MACHINE>Software>Wow6432Node>CRYPTO...

In HKLM\Software\Wow6432Node, is there perhaps \Microsoft\Internet Explorer\AdvancedOptions\CRYPTO? (Just a guess: x86 here.)

 

[wither 3]

Yes. You're absolutely correct. Strange that it wasn't picked up when I ran a search for Crypto last night. Maybe I stopped it for some reason before it finished. It did find many other entries with "crypto" within a word but none of the ones I looked at had the OS version name.

TSL1.1 and TSL1.2 both have the OS version he mentioned. I'm using TSL1.0. Neither TSL1.0 nor the SSL entries have a OS Version Name.

Not sure what to do with that because, I mentioned previously my trials and tribulations trying to install the update, which was unsuccessful.

 

[Vistaar]

Yes. You're absolutely correct....TSL1.1 and TSL1.2 both have the OS version he mentioned...

Congratulations wither 3! After only 9 posts in this thread over the last 8 months, you have already completely clarified the procedure for enabling TLS 1.1 and 1.2 for IE9 on a system running Vista x64! (Of course VistaLover's instructions reproduced in post #1 were quite sufficient for Vista x86 systems in the first place.)

In your case, the first step might be to completely undo all of your earlier attempts to reinvent the wheel as detailed in post #3, if you haven't already done so. As brilliant as they were, they did not hit the nail on the head like your latest discovery. The simplest way to do that might be to restore from an image created before June 30, 2018. Then again, the last guru running Vista x64 at vistax64.com may have no need for simple methods.

You stated in post #12 that you have "updated all the way to December 2018," so I wouldn't worry about KB4019276: It has already been superseded at least once, according to a later post in VistaLover's thread. Support for TLS 1.1 and 1.2 is already installed; you just have to eliminate the OSVersion keys as discussed earlier. Your original failure was because the two instances in Wow6432Node were not deleted (because VistaLover is running x86 and did not know about Wow6432Node, nor did I). I'm a little concerned that Microsoft may have modified later updates to more effectively block Vista - but they wouldn't be that mean, would they?

 

[wither 3]

I deleted the version number in the tsl1.1 and tsl1.2 keys. I didn't reboot but now, in IE 9 those show up and I can select them. I don't know whether or not to enable just the tsl1.2 or to also use tsl1.0 and tsl1.1.