XP POSReady and TLS 1.2 - ssl

Question

I'm trying to use TLS 1.2 on Windows XP POSReady after having installed the Microsoft released KB4019276 - https://support.microsoft.com/en-us/help/4019276/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows) and enabled it in registry.
My very simple code to test it is :
Option Explicit
Const WinHttpRequestOption_SecureProtocols = 9
Const SecureProtocol_SSL2 = 8, SecureProtocol_SSL3 = 32, _
SecureProtocol_TLS1 = 128, SecureProtocol_TLS1_1 = 512, _
SecureProtocol_TLS1_2 = 2048
Dim objHTTP
Set objHTTP = CreateObject("WinHttp.WinHttprequest.5.1")
objHTTP.open "GET", "https://www.howsmyssl.com/a/check", False
objHTTP.Option(WinHttpRequestOption_SecureProtocols) = SecureProtocol_TLS1_2
objHTTP.Send
If objHTTP.WaitForResponse(30) Then 'wait up to 30 seconds
WScript.Echo "Status : " & objHTTP.Status & "<br />"
WScript.Echo "Response Length : " & LenB(objHTTP.ResponseBody)
WScript.Echo "Response Text : " & objHTTP.ResponseText
Else
WScript.Write "Request timed out"
End If
Set objHTTP = Nothing
but anything over TLS 1.0 is giving me the error :
Invalid argument for Option
while, disabling SSL 2.0, SSL 3.0 and TLS 1.0 I'me getting an error about not being able to negotiate a security protocol.
any advice ?
Thank you.

Answer 1

IF actually have the same problem on my expermiental Winxp sp3 (all further updates included).
I found out that WINHTTP.DLL does still not contain the API Call function
SECUREPROTOCOL_TLS1_1 as well as SECUREPROTOCOL_TLS1_2.
Causing the "invalid option" error.
So, this syntax isn't supported on standard XP systems !
(winhttp.dll not getting updated). ONly embeddedXP might have optained an updated winhttp.dll file accepting this option.
I now make efforts to somehow obtain the updated ominous winhttp.dll.
Results will be reported here.

Answer 2

Here is what ssllabs client test looks like after applying KB4019276
Protocols
TLS 1.3 No
TLS 1.2 Yes*
TLS 1.1 Yes*
TLS 1.0 Yes*
SSL 3 Yes*
SSL 2 No
Cipher Suites (in order of preference)
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) WEAK 256
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) WEAK 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK 256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK 128
TLS_RSA_WITH_RC4_128_MD5 (0x4) INSECURE 128
TLS_RSA_WITH_RC4_128_SHA (0x5) INSECURE 128
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) WEAK 112
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 (0x6a) WEAK 256
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (0x40) WEAK 128
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x13) WEAK 112
Protocol Details
Server Name Indication (SNI) No
Secure Renegotiation Yes
TLS compression No
Session tickets No
OCSP stapling No
Signature algorithms SHA256/RSA, SHA384/RSA, SHA1/RSA, SHA1/DSA, SHA512/RSA
Named Groups -
Next Protocol Negotiation No
Application Layer Protocol Negotiation No
SSL 2 handshake compatibility No
There are no ECDHE negotiating cipher suites so everything is deemed WEAK or outright INSECURE.

Answer 3

Folks. The relevant Update for enabling TLS 1.2 in XP has been re-released
as of 18 Feb 2018. (KB4019276). Downloaded from the MS UpdateCatalog.
This is a correction for the (obviously buggy) initial release in October 2017.
Which now WORKS correctly !
Features in IE8 : TLS 1.2 enabled
included also : TLS Session Ticket support
NEW available Suites (howsmyssl.com, ssllabs):
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) FS 128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) FS 128
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9) FS 256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) FS 256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) FS 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) FS 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) FS 256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) FS 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) FS 256
Supported Named groups for EC : secp256r1, secp384r1, secp521r1
Kind Regards!
BerndP