4 ms·

I know I'm in the minority on here, but... LetsEncrypt's certs are not trusted on Blackberrys (including BB10 devices), and because Blackberry's big thing is '

by Jaruzel 10y ago

I know I'm in the minority on here, but... LetsEncrypt's certs are not trusted on Blackberrys (including BB10 devices), and because Blackberry's big thing is 'a secure OS' there's no way to side-load[1] a root cert. Although dwindling rapidly - there's still some big business out there that are still issuing Blackberrys to it's users. My main home server is behind a StartCom cert... and I use a BB10 device - so no LetsEncrypt migration for me :( -- [1] Happy to be corrected on this, If I'm wrong!

koolba 10y ago
> LetsEncrypt's certs are not trusted on Blackberrys (including BB10 devices), and because Blackberry's big thing is 'a secure OS' there's no way to side-load[1] a root cert. > Although dwindling rapidly - there's still some big business out there that are still issuing Blackberrys to it's users. What business are you in that Blackberry users are a factor? What percent (or total number of users) would be impacted? Only time I've seen a Blackberry in recent memory is as a stock image on a "Why RIM failed..." article.
- Jaruzel 10y ago
  Believe it or not - Large Financial still roll out BBs, mainly because they have a big investment in the BES backend, and don't want to replace it unless they absolutely HAVE to. Latest version of BES (v12) supports iPhone and Android now, but it's not as complete as native BB support. My Blackberry is personal though (I love hard keyboards!).
kstrauser 10y ago
That's a pickle to be in. Until LetsEncrypt is trusted on BB, you might consider switching to a different traditional CA. For example, Namecheap resells Comodo certs for $9 per year: https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx https://www.namecheap.com/security/ssl-certificates/domain-v... . That's what I was using on my personal domains until LetsEncrypt came around. If you can afford a home server, $9 is cheap. It's way cheaper than what StartCom will charge you to revoke your cert if you ever need to (security breach, the next heartbleed, etc.). In fact, StartCom's terrible handling of heartbleed is what prompted me to switch from their free-but-expensive certs to Namecheap/Comodo's paid-but-cheap service.
- Jaruzel 10y ago
  Yeah, I guess it's time to stump up cash for a proper cert. I actually need about 5 tho...
aianus 10y ago
I would be very surprised if there was no way to side load root CAs on enterprise deployments of Blackberry. Enterprises love to MITM SSL (and may also have their own CAs to issue certs for internal services). Even Chrome ignores cert pinning if the CA is user-installed for this reason.
jaas 10y ago
We have been working on Blackberry 10 support for a while. While we can't commit to a date yet, we have good reason to believe that your issue will be solved with a software update soon.
joecool1029 10y ago
I manually added their cross-signing cert months ago and trusted them on my BB10 devices. Works fine. Haven't added the new root yet. You'll need to download them manually to the phone then go to Settings > Security and Privacy > Certificates > Import As an aside, I found this amusing: https://community.letsencrypt.org/t/inclusion-of-isrg-root/9002/6 https://community.letsencrypt.org/t/inclusion-of-isrg-root/9...

by Jaruzel 10y ago

koolba 10y ago

> LetsEncrypt's certs are not trusted on Blackberrys (including BB10 devices), and because Blackberry's big thing is 'a secure OS' there's no way to side-load[1] a root cert. > Although dwindling rapidly - there's still some big business out there that are still issuing Blackberrys to it's users. What business are you in that Blackberry users are a factor? What percent (or total number of users) would be impacted? Only time I've seen a Blackberry in recent memory is as a stock image on a "Why RIM failed..." article.

Jaruzel 10y ago
Believe it or not - Large Financial still roll out BBs, mainly because they have a big investment in the BES backend, and don't want to replace it unless they absolutely HAVE to. Latest version of BES (v12) supports iPhone and Android now, but it's not as complete as native BB support. My Blackberry is personal though (I love hard keyboards!).

kstrauser 10y ago

That's a pickle to be in. Until LetsEncrypt is trusted on BB, you might consider switching to a different traditional CA. For example, Namecheap resells Comodo certs for $9 per year: https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx https://www.namecheap.com/security/ssl-certificates/domain-v... . That's what I was using on my personal domains until LetsEncrypt came around. If you can afford a home server, $9 is cheap. It's way cheaper than what StartCom will charge you to revoke your cert if you ever need to (security breach, the next heartbleed, etc.). In fact, StartCom's terrible handling of heartbleed is what prompted me to switch from their free-but-expensive certs to Namecheap/Comodo's paid-but-cheap service.

Jaruzel 10y ago
Yeah, I guess it's time to stump up cash for a proper cert. I actually need about 5 tho...

aianus 10y ago

I would be very surprised if there was no way to side load root CAs on enterprise deployments of Blackberry. Enterprises love to MITM SSL (and may also have their own CAs to issue certs for internal services). Even Chrome ignores cert pinning if the CA is user-installed for this reason.

jaas 10y ago

We have been working on Blackberry 10 support for a while. While we can't commit to a date yet, we have good reason to believe that your issue will be solved with a software update soon.

joecool1029 10y ago

I manually added their cross-signing cert months ago and trusted them on my BB10 devices. Works fine. Haven't added the new root yet. You'll need to download them manually to the phone then go to Settings > Security and Privacy > Certificates > Import As an aside, I found this amusing: https://community.letsencrypt.org/t/inclusion-of-isrg-root/9002/6 https://community.letsencrypt.org/t/inclusion-of-isrg-root/9...