An update that enables Internet Explorer in Windows XP, in Windows Vista, or in Windows Server 2008 to parse fragmented TLS/SSL handshake messages is available

In certain situations, TLS/SSL handshake messages become too large to be contained in a single packet. In these situations, some third-party implementations of the TLS/SSL protocol fragment the messages before they are sent. However, the Microsoft implementation of the TLS/SSL protocol cannot parse fragmented messages. Therefore, Windows Internet Explorer on a computer that is running Windows XP, Windows Vista, or Windows Server 2008 cannot connect to servers that use a third-party TLS/SSL protocol. Additionally, you receive the following error message when you try to connect to such a server.

Update information

This update enables the Microsoft implementation of the TLS/SSL protocol to successfully parse fragmented messages that are sent by a third-party implementation of the TLS/SSL protocol.

After you install the update, you can use registry keys to configure the maximum size of a fragmented message that the Microsoft implementation of the TLS/SSL protocol can parse. You can also use these registry keys to prevent the Microsoft implementation of the TLS/SSL protocol from processing fragmented messages.

To configure how the Microsoft implementation of the TLS/SSL protocol handles fragmented TLS/SSL messages, create the appropriate registry key for you environment under the following registry subkey:

On a client computer

• Registry key: MessageLimitClient
• Type: REG_DWORD
• Value:
  • Null
    
    If you do not create this registry entry, the maximum allowed size of a fragmented message is 0x8000 bytes.
  • 0x0
    
    If you set the value to 0x0, fragmented message are not processed.
  • Between 0x0 and 0x8000
    
    If you set a value between 0x0 and 0x8000, the value indicates the maximum allowed size (in bytes) of a fragmented message.
  • Greater than 0x8000
    
    If you set a value greater than 0x8000, the maximum allowed size of a fragmented message is 0x8000 bytes.
    

On a server that does not use client authentication

• Registry key: MessageLimitServer
• Type: REG_DWORD
• Value:
  • Null
    
    If you do not create this registry entry, the maximum allowed size of a fragmented message is 0x4000 bytes.
  • 0x0
    
    If you set the value to 0x0, fragmented message are not processed.
  • Between 0x0 and 0x4000
    
    If you set a value between 0x0 and 0x4000, the value indicates the maximum allowed size (in bytes) of a fragmented message.
  • Greater than 0x4000
    
    If you set a value greater than 0x4000, the maximum allowed size of a fragmented message is 0x4000 bytes.
    

On a server that uses client authentication

• Registry key: MessageLimitServerClientAuth
• Type: REG_DWORD
• Value:
  • Null
    
    If you do not create this registry entry, the maximum allowed size of a fragmented message is 0x8000 bytes.
  • 0x0
    
    If you set the value to 0x0 and the value of the MessageLimitServer registry entry to 0x0, fragmented messages are not processed. Otherwise, the value of the MessageLimitServer registry entry indicates the maximum allowed size of a fragmented message.
  • Between 0x0 and 0x8000
    
    If you set a value between 0x0 and 0x8000, the maximum allowed size of a fragmented message is calculated by using the following formula:
    max(MessageLimitServerClientAuth, MessageLimitServer)
  • Greater than 0x8000
    
    If you set a value greater than 0x8000, the maximum allowed size of a fragmented message is 0x8000 bytes (if the MessageLimitServer registry entry is not set to be a value of 0x0).
    

How to obtain this update

The following files are available for download from the Microsoft Download Center:
For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

To apply this update, you must be running one of the following operating systems:

• Windows XP Service Pack 3 (SP3)
• Windows Vista Service Pack 1 (SP1)
• Windows Vista Service Pack 2 (SP2)
• Windows Server 2008
• Windows Server 2008 Service Pack 2 (SP2)

For more information about how to obtain a Windows XP service pack, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to obtain a Windows Vista service pack, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to obtain a Windows Server 2008 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

Registry information

To use the update in this package, you do not have to make any changes to the registry.

Restart requirement

You may have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: