Timeline for Let's Encrypt: Is there a workaround for the 2021 SSL "cutoff" for pre-7.1.1 Android devices?
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 5 at 15:37 | comment | added | Robert | @1NN If you have such an old Android phone you should root it (will erase all user data). Then you can add the new certificate as system certificate using root permissions. There is no other way on a non-rooted system. | |
| Sep 5 at 15:31 | comment | added | 1NN | @Robert So there's no way to have an app like Whatsapp accept a user certificate? All my sharing links are broken ... | |
| Apr 10 at 7:44 | comment | added | Robert | @EndAnti-SemiticHate Chrome also accepts user certificates (but some random versions or installations will check if the CA is a Certificate Transparency CA, which proxy CAs like the one from AdGuard are not). But nearly all other apps won't accept user certs. This means Installing the Let's encrypt root CA certs should work for Chrome but other apps that don't trust user certs that use servers with Let's encrypt certs will fail. | |
| Apr 10 at 7:38 | comment | added | Amazon Dies In Darkness | Thanks for that article. If I'm reading it correctly, it sounds like even on non-rooted devices, some browsers will accept certificates added to the user store. I can't recall if Firefox is one of those browsers, but if it is, that could be a good workaround. Separately, if one used AdGuard to disable OCSP checks, would that only apply to apps that accept user certificates? | |
| Apr 10 at 7:30 | history | edited | Amazon Dies In Darkness | CC BY-SA 4.0 |
Fixed a date typo
|
| Apr 10 at 7:19 | history | edited | Robert | CC BY-SA 4.0 |
added 732 characters in body
|
| Apr 10 at 7:14 | comment | added | Robert | @EndAnti-SemiticHate AdGuard has the same problem: adguard.com/kb/de/adguard-for-android/solving-problems/… | |
| Apr 10 at 7:13 | comment | added | Amazon Dies In Darkness | @Robert What about using a tool like AdGuard that can process all HTTPS traffic? IIRC, it can even disable OCSP checks. Now, of course, that would come with its own big set of risks, so such an action should not be taken without understanding those risks. | |
| Apr 10 at 6:59 | comment | added | Robert | @EndAnti-SemiticHate Sorry but on those Android versions there is simply no way to install a trusted root CA as user that is in the end trusted by all apps. The only way is a rooted device. | |
| Apr 10 at 6:16 | comment | added | Amazon Dies In Darkness | Are there any further updates? Any way to update certificates on non-rooted older, but not really old, devices (e.g. after Android 5, but before Android 8?)? | |
| Jul 11, 2023 at 13:45 | history | edited | Robert | CC BY-SA 4.0 |
added 319 characters in body
|
| Oct 30, 2021 at 9:44 | comment | added | Bento | In my case (android.stackexchange.com/q/242440/196632) I've got the ISRG Root X1 automatically in user installed certificates, without any action from me. It is as if it has self-installed itself. How was it possible? | |
| Oct 29, 2021 at 7:51 | history | edited | Robert | CC BY-SA 4.0 |
added 485 characters in body
|
| Sep 30, 2021 at 21:13 | vote | accept | Alexander M | ||
| Dec 23, 2020 at 10:51 | history | edited | Robert | CC BY-SA 4.0 |
added 2261 characters in body
|
| Dec 19, 2020 at 10:12 | history | edited | Robert | CC BY-SA 4.0 |
added 193 characters in body
|
| Dec 17, 2020 at 12:56 | history | edited | Robert | CC BY-SA 4.0 |
added 1 character in body
|
| Dec 17, 2020 at 12:44 | history | edited | Robert | CC BY-SA 4.0 |
added 1 character in body
|
| Dec 17, 2020 at 12:38 | history | edited | Robert | CC BY-SA 4.0 |
changed from DER to PEM certificates
|
| Dec 17, 2020 at 12:30 | history | answered | Robert | CC BY-SA 4.0 |