Ondrej Sevecek's English Pages

Very common problem with SHA2 (SHA-256) on Windows 2003 and Windows XP SP3 is that it does not work :-) Although not every functionality with SHA-256 certificates is supported anyway, yet in order to make it as working as possible, you must install some updates which are not distributed automatically through Windows/Microsoft Update and you must request them online from the support site (note the big green button up on the page telling you Hotfix Download Available):

• Applications that use the Cryptography API cannot validate an X.509 certificate in Windows Server 2003
• Windows Server 2003 and Windows XP clients cannot obtain certificates from a Windows Server 2008-based certification authority (CA) if the CA is configured to use SHA2 256 or higher encryption

You may also be interested in adding AES support for schannel (TLS/SSL) provider into Windows 2003. Although this does not make it support SHA-256 cryptographic suites, it at least enables AES and AES256.

• An update is available to adds support for the TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA and the TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA AES cipher suites in Windows Server 2003

Cheers!