[Update: Crisis Averted] Many websites could potentially break on older Android phones in 2021

Update 1 (12/22/2020 @ 01:01 AM ET): Let’s Encrypt has found a way for older Android phones to continue visiting sites that use their certificates next year. The original article, as published on November 9, 2020, is preserved below.

Although Project Treble has played a major role in improving the distribution of the latest versions of Android over the last few years, fragmentation remains one of the biggest shortcomings of the Android ecosystem. A huge chunk of Android devices currently in use run out-of-date versions of the operating system, and that can lead to a variety of issues. For instance, many websites could potentially break on older Android devices next year due to an expiring root certificate.

When Let’s Encrypt, a non-profit certificate authority that provides free certificates for TLS encryption, first launched several years ago, the organization cross-signed signatures with IdenTrust’s DST Root X3 certificate, a root certificate that has been in use for years and is trusted by the majority of major software platforms, including Windows, iOS, Android, macOS, and many Linux distributions. To date, millions of web domains are protected with Let’s Encrypt certificates, but as pointed out in a recent blog post from Let’s Encrypt, the DST Root X3 root certificate will expire on September 1, 2021.

Let’s Encrypt’s partnership with IdenTrust was necessary for the former’s certificates to quickly be trusted by existing devices, but at the same time, the organization issued its own root certificate (ISRG Root X1) and worked to have it be trusted by most major operating systems. However, some software that hasn’t been updated since 2016 won’t trust the new root certificate, which includes Android devices running versions less than 7.1.1. Therefore, when the DST Root X3 root certificate expires next year, many older Android devices will no longer trust certificates issued by Let’s Encrypt and will thus get certificate errors when visiting websites whose TLS encryption is signed with a Let’s Encrypt certificate.

According to the latest Android distribution statistics derived from Android Studio (shown below), 33.8% of Android devices in circulation as of April 2020 run Android versions older than 7.1 Nougat. This represents around 1-5% of traffic to websites that have a Let’s Encrypt certificate. While the percentage of devices running older Android OS versions will undoubtedly decrease by the time DST Root X3 expires next year, the drop in percentage may not be significant based on current trends.

To minimize the impact of this change for end-users, Let’s Encrypt has offered two solutions. The first solution, which is directed at website owners, will introduce a change to the Let’s Encrypt API in January next year so that “ACME clients will, by default, serve a certificate chain that leads to ISRG Root X1. However, it will also be possible to serve an alternate certificate chain for the same certificate that leads to DST Root X3 and offers broader compatibility.”

For end-users who have a device running an older version of Android, Let’s Encrypt suggests installing Firefox to circumvent this issue. Unlike stock browser apps, which rely on the operating system for the list of trusted root certificates, Firefox ships with its own trusted root certificates list. The latest version of Firefox for Android includes an up-to-date list of trusted certificate authorities, and it will allow users with an outdated version of Android to open websites that have a Let’s Encrypt certificate.

Firefox Browser: fast, private & safe web browser (Free, Google Play) →

Update 1: Older Android Device Compatibility Extended for Let’s Encrypt Certificates

As announced today in a blog post, older Android devices running Android versions prior to 7.1.1 will be able to visit sites that use Let’s Encrypt certificates after their original cross-sign partnership with IdenTrust expires next year. It turns out that Android doesn’t “enforce the expiration dates of certificates used as trust anchors.” Because of this, IdenTrust has issued a 3-year cross-sign agreement for Let’s Encrypt’s ISRG Root X1 certificate from their DST Root CA X3, even though the latter will expire next year.  As such, there will be no impact on users with older Android phones, avoiding the potential breakage of many websites on those devices.

The post [Update: Crisis Averted] Many websites could potentially break on older Android phones in 2021 appeared first on xda-developers.

from xda-developers https://ift.tt/3kcqifG
via IFTTT