Thunderbird 38.5.0 is now available / special notice

R Kent James kent at
Wed Dec 23 21:01:33 UTC 2015

On 12/23/2015 12:40 PM, Wayne Mery (Thunderbird QA) wrote:
> * In a week or two a version 38.5.1 will be made available. It is 
> planned, and not necessarily a security update. The primary purpose, 
> together with 38.5.0, is to allow Windows XP users to UPDATE 
> Thunderbird after Microsoft deprecates SHA1 on the XP platform [1]. 
> (The same thing is being done for Firefox [2]) 
Important correction: The SHA-1 deprecation issue affects all versions 
of Windows, not just XP. XP has special issues, as XP SP2 or earlier 
have no support at all for the newer SHA-2 certificates, which are 
required for later versions of Windows.

We have not decided what to do about XP SP2 yet. Very rough estimate, it 
is about 4% of our users. XP SP3 or later should support the newer SHA-2 
certificates, but not all users updated to SP3 because of some issues 
with the "Genuine" management program of Microsoft, even for legitimate 

One possibility is to drop support completely for XP SP2 or earlier. The 
other option is to have additional builds, signed with older 
certificates, that will install on XP SP2 or earlier. That solution 
might only be valid for another year or so, however.


More information about the tb-planning mailing list