SSL certificate problem before Android 7.1 was fixed

Devices running Android versions prior to 7.1.1 are websites that use certificates issued by Let’s Encrypt, an SSL certificate authority, in January 2021. There is a problem that communication becomes impossible.

This is because the current Let’s Encrypt issued certificate mutually sign the DST Root CA X3 of another certification body, IdenTrust, to enable secure access to websites around the world, but the validity period expires on September 30, 2021.

Let’s Encrypt is clarifying the transition to ISRG Root X1 from the new issuance of the certificate in January 2021. However, devices prior to Android 7.1 do not support ISRG Root X1 certificates and do not provide updates, which significantly limits internet access.

On this issue, Identity Trust and Let’s Encrypt have announced that they have agreed to mutually sign Let’s Encrypt’s ISRG Root X1 signature at Identity Trust’s DST Root CA X3, which expires. With this measure, older Android devices that used DST Root CA X3 can achieve the same effect as using ISRG Root X1 for the next three years. DST Root CA X3 expires, so this is an incorrect measure in the first place, but it works well for the certificate handling specification implemented by Android. It can be said to be a technical solution.

According to the University of Michigan survey, 33.8% of Google Pay devices are still running Android 7.1 or earlier. These various terminal users can continue to surf the web safely without being aware of anything.

Even if the Android certificate doesn’t work, it’s possible to view the website by using a browser app like Firefox Mobile inside your root certificate. However, it is clear that replacing the device with a new model is convenient for security and convenience of use rather than continuing to use the device. Related information can be found here .