8

According to a well-regarded QA answer by a member of our Android community here on Stack Exchange:

By the current schedule, Let's Encrypt cross signing will end on September the 30th 2024. After this date Android 7.1 stock devices will become more or less useless for Internet surfing as all Let's encrypt based certificates will be considered untrusted and the connection will not be established.

Has this schedule changed? I haven't seen any announcement of a change, but I've noticed that affected devices suddenly have certificate validation failures when trying to connect to many internet hosts. The problem seems to stem from Let's Encrypt R3, which is affected by the changes that were supposed to be effective much later this year.

Is there any documentation as to why these devices are being affected earlier than planned? Are there any workarounds for non-rooted devices?

Relevant:

Improve this question
2
  • By "suddenly", did you mean very recently, i.e. today? this week?
    – Andrew T. ♦
    Commented Apr 10 at 7:11
  • @AndrewT. Good question. Fortunately, I'm not around technology all the time, so I don't know exactly when people started having issues. But I think during the last few weeks is a reasonable estimate.
    – Amazon Dies In Darkness
    Commented Apr 10 at 7:16

1 Answer 1

Reset to default
7

The relevant article is: https://letsencrypt.org/2023/07/10/cross-sign-expiration.html

On Thursday, Feb 8th, 2024, we stopped providing the cross-sign by default in requests made to our /acme/certificate API endpoint. For most Subscribers, this means that your ACME client will configure a chain which terminates at ISRG Root X1, and your webserver will begin providing this shorter chain in all TLS handshakes. The longer chain, terminating at the soon-to-expire cross-sign, will still be available as an alternate chain which you can configure your client to request.

Therefore the cross signing still works, but by default most server certificates will no longer be created in a way that make use of the cross signing certificate chain - which from the user perspective means Let's encrypt certificates that have been issued after Feb. 8th will by default no longer work on Android 5.0-8.0 (in stock state).

Improve this answer
5
  • Thanks. Does that mean it should have stopped working on Feb 8, or would there have been a substantial propagation period (greater than 24 hours)?
    – Amazon Dies In Darkness
    Commented Apr 10 at 7:17
  • 1
    @EndAnti-SemiticHate Certificates that have been issued before will still work until they expire. The life time of a Let's Encrypt certificate is usually 90 days, so today is day 62 of 90, which means two third of all servers that use Let's encrypt certs should no longer be usable on Android prior to 8.1 (unless the server admin has configured the Let's encrypt cert creator to still use the cross signing cert chain which works until June 6th).
    – Robert
    Commented Apr 10 at 7:23
  • Can you explain that in just a little more detail, please? Why, when the certs expire after 90 days, would 2/3 of all servers be in that situation after 90*(2/3)? The math makes perfect sense (which is why I chose to write the previous sentence using long-form math), but I'm trying to understand the reasoning behind the math.
    – Amazon Dies In Darkness
    Commented Apr 10 at 7:28
  • 2
    @EndAnti-SemiticHate Let's encrypt server Certificates have to be renewed every 90 days, so all servers that had their last cert update before Feb 8th got the cross signing version which will still work with old Android versions. But as not every server has started using Let's encrypt at the same day the 90 days period is different for each server. Assuming the days a server has to refresh the certificate is uniformly distributed among the 90 days, you can say that after 2/3 of the 90 days have passed, 2/3 of the servers have already updated their certificate after Feb 8th.
    – Robert
    Commented Apr 10 at 7:38
  • 1
    Thank you for explaining that like I'm a very intelligent 5 year old, which is exactly what I needed in this case. :) Now it makes perfect sense.
    – Amazon Dies In Darkness
    Commented Apr 10 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .