I tried asking this on xdaforums but did not get a useful answer so I thought I would try here.

I've got some very old devices (used as wifi-only) that are starting to have issues connecting to (some but not all) modern websites. One runs FroYo, another Ice Cream Sandwich. They are both rooted and I have ADB working on both of them. Some of the sites in question are using very little javascript, so even the old browsers that can be installed on them used to connect okay until VERY recently. I have succeeded in updating the root certs on both of these, which has helped with some web sites, but not all. The troublesome change seems related to certificate updates on some of the websites. Where they used to be using TLS1.1 and certs based on SHA1, they have changed to TLS 1.3 and SHA256, which these old devices don't support.

I should add that this is not just about browsers. There are similar issues with other apps like email, VoIP callling, XMPP clients, weather apps, pretty much anything that needs network access. There are also issues connecting to certain specific (but not all) wifi networks, I suspect a similar cause for this too.

So, I want to update the version of libssl.so used on these devices. I have found some instructions on how to compile this, which looks like it will be an adventure unto itself (and maybe a separate topic for further questions).

One helpful detail about devices this old, they do not yet use dm-verity, so at least I will not need to bother about dealing with that.

Before I get too far down the compilation rabbit hole, assuming I manage to get it compiled correctly, is it really as simple as just dropping the replacement files into /system/lib ? Do I also need to update libcrypt.so at the same time? Or are there other items I would also need to update? Has anyone done this before, short of rebuilding the entire ROM?

  • 1
    Older versions of libssl are not API compatible to newer versions, which means that you cannot simply replace libssl. The actual applications must be compiled against the new lib and maybe changes are needed in the applications too. Nov 15 at 11:31
  • 2
    Your main problem is most likely not libssl but Chrome respectively the WebView component which I think is no longer updated for these old Android versions. As far as I know Chrome and WebView contain their won SSL/TLS stack and don't make use of libssl from Android. Only apps that open a TLS connection by Java/Kotlin (DEX) code make use of Android libssl.
    – Robert
    Nov 15 at 11:50
  • 1
    The Google recommended way handling TLS issues on older devices (I think 4.0+ is at least supported) is using a special crypto provider that comes with Google Play Services. Apps can enable this if necessary by one code line. For details see e.g. code.mendhak.com/tls-13-old-android-devices and developers.google.com/android/reference/com/google/android/gms/…
    – Robert
    Nov 15 at 21:18
  • 1
    An alternative solution might be to proxy the modern sites on a PC/local server so that the older browsers can access them, see: Proxy (or other solution) that can allow vintage browsers (before HTTPS era - with no or weak SSL/TLS support) to connect with HTTPS websites? Nov 16 at 23:45
  • 1
    @ILikeOldStuff I really wouldn't be running old (Froyo released in 2010) devices outside. While you may want to keep things around, legacy bugs like Stagefright may exist in those versions. Additionally modern sites are using modern HTML/CSS which require modern webkit engines which now run on multi core CPUs. Proxy PC is doing heavy lifting. More FYI, Project Crosswalk existed for consistent webkit on 2.x-4.x hw. You'll have to find docs on archive.org as site is gone and web standards change. Nov 17 at 5:56


You must log in to answer this question.

Browse other questions tagged .