I had a friend who had the same general problem discussed here:
He wanted to use one of those internet services that electronically
pay you monthy bills. But it used 128 bit encryption.
I solved his problem by finding where to download netscape 4.7
for windows 3.1. Strangely, as recently as a year ago netscape still
ported a relatively recent version of their browser to the old windows
3.1, and it includes 128 bit encryption. At this point, I can not
comment about the certificates.
Survpc owners who mostly use dos, probably have win 3.1 and may use
it seldom. At least win 3.1 is not as bloaty as its successors, and
does not require as much hardware. I am not aware of an entire
dos only solution.
There is also a japanese freeware program that consists of a
proxy server that runs in a dos box under win95 and beyond. It
includes a SSL 128 bit encryption filter, so you can run internet
programs that do not have this capability through it before data
goes out your port. I can look up this program if some are interested.
But this sends you into true bloatware country. I would much rather
install Linux or FreeBsd on a survpc than some version of windows 9x.