5 ms·

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ https://valid-isrgrootx1.letsencrypt.org/ People with other ver

by p4bl0 8y ago

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?

gpvos 8y ago
That site should have some text on it like "If you did not get any errors or warnings while opening this web page, your computer or device knows about the ISRG root certificate and Let's Encrypt will continue to work for you." Currently, this isn't immediately clear to (relative) laypeople like me.
- tialaramex 8y ago
  That test site, though they do link it in their own announcement was actually created as part of their compliance with root trust programme conditions. Specifically Mozilla's conditions require them to prove their setup actually works (modulo the trust they're requesting) by setting up a web site with certificates that would work once that trust is granted. They were also required to provide example sites with e.g. expired certs so that a Firefox developer could check that does what you'd expect. The good news is that unlike some of the required test sites, which took a bunch of advanced planning (you can't ask Let's Encrypt's service to mint you an expired cert so the expired cert was produced by requesting a valid cert and then waiting for it to expire and making sure not to lose it...) this test is easy for anybody knowledgeable to manually reproduce in a few minutes, as it's just the "wrong" certificate chain with the good trusted leaf certificate you got from Let's Encrypt. So even if they don't heed your call I'm sure someone else can.
Fradow 8y ago
Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7). This is going to be problematic, as there are still devices currently for sale on Android 5/6 (such as the aformentionned Galaxy Tab A 7", which doesn't have a replacement on some markets).
- LeonM 8y ago
  > This is going to be problematic, as there are still devices currently for sale on Android 5/6 If I recall correctly, Android >=5 has pretty decent support for modern crypto (such as TLS V1.2, ECC). So, Android 5/6 could still just work, if the vendor is bothered to update the CA root store.
  - gmueckl 8y ago
    Vendor updates for cheap Android phones? Dream on!
- kalleboo 8y ago
  - FAIL on a Kindle Fire 7 (which is still for sale new) in Chrome running the latest update from November 2018 [based on Android 5.1.1].
- jeroenhd 8y ago
  As a tip to you/your company: unlike Chrome and most Chrome-based browsers, Firefox for Android has a separate root certificate store and your old devices will still be able to access Letsencrypt websites if you switch browsers.
  - Fradow 8y ago
    Thank you for the tip. The issue is not so much about the browser, as I'm an app editor (which happens to also sell tablets with our apps preinstalled to reduce friction). The issue is that apps that rely on the device certificate store aren't going to be able to use https with a server using a Let's Encrypt certificate issued with the new root CA. Shipping a root certificate store would be (for my scale) a bad practice. I made the mistake of pinning a SSL key in the past, never again (you run into issues when your clients never even connect the device to the internet in 3+ years, and then your updater doesn't work anymore). Fortunately for me, I don't currently use Let's Encrypt for my API servers, and that news was the last straw to make the boss decide we will stop selling Android 5 devices. Unfortunately, this means our users who recently bought those devices will have some third-party apps might be broken starting 9th of July, and some sites will give a scary warning.
throw0101a 8y ago
* https://www.ssllabs.com/ssltest/analyze.html?d=valid%2disrgrootx1.letsencrypt.org https://www.ssllabs.com/ssltest/analyze.html?d=valid%2disrgr...
seba_dos1 8y ago
Works on Nokia N900.

by p4bl0 8y ago

gpvos 8y ago

That site should have some text on it like "If you did not get any errors or warnings while opening this web page, your computer or device knows about the ISRG root certificate and Let's Encrypt will continue to work for you." Currently, this isn't immediately clear to (relative) laypeople like me.

tialaramex 8y ago
That test site, though they do link it in their own announcement was actually created as part of their compliance with root trust programme conditions. Specifically Mozilla's conditions require them to prove their setup actually works (modulo the trust they're requesting) by setting up a web site with certificates that would work once that trust is granted. They were also required to provide example sites with e.g. expired certs so that a Firefox developer could check that does what you'd expect. The good news is that unlike some of the required test sites, which took a bunch of advanced planning (you can't ask Let's Encrypt's service to mint you an expired cert so the expired cert was produced by requesting a valid cert and then waiting for it to expire and making sure not to lose it...) this test is easy for anybody knowledgeable to manually reproduce in a few minutes, as it's just the "wrong" certificate chain with the good trusted leaf certificate you got from Let's Encrypt. So even if they don't heed your call I'm sure someone else can.

Fradow 8y ago

Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7). This is going to be problematic, as there are still devices currently for sale on Android 5/6 (such as the aformentionned Galaxy Tab A 7", which doesn't have a replacement on some markets).

LeonM 8y ago
> This is going to be problematic, as there are still devices currently for sale on Android 5/6 If I recall correctly, Android >=5 has pretty decent support for modern crypto (such as TLS V1.2, ECC). So, Android 5/6 could still just work, if the vendor is bothered to update the CA root store.
- gmueckl 8y ago
  Vendor updates for cheap Android phones? Dream on!
kalleboo 8y ago
- FAIL on a Kindle Fire 7 (which is still for sale new) in Chrome running the latest update from November 2018 [based on Android 5.1.1].
jeroenhd 8y ago
As a tip to you/your company: unlike Chrome and most Chrome-based browsers, Firefox for Android has a separate root certificate store and your old devices will still be able to access Letsencrypt websites if you switch browsers.
- Fradow 8y ago
  Thank you for the tip. The issue is not so much about the browser, as I'm an app editor (which happens to also sell tablets with our apps preinstalled to reduce friction). The issue is that apps that rely on the device certificate store aren't going to be able to use https with a server using a Let's Encrypt certificate issued with the new root CA. Shipping a root certificate store would be (for my scale) a bad practice. I made the mistake of pinning a SSL key in the past, never again (you run into issues when your clients never even connect the device to the internet in 3+ years, and then your updater doesn't work anymore). Fortunately for me, I don't currently use Let's Encrypt for my API servers, and that news was the last straw to make the boss decide we will stop selling Android 5 devices. Unfortunately, this means our users who recently bought those devices will have some third-party apps might be broken starting 9th of July, and some sites will give a scary warning.

throw0101a 8y ago

* https://www.ssllabs.com/ssltest/analyze.html?d=valid%2disrgrootx1.letsencrypt.org https://www.ssllabs.com/ssltest/analyze.html?d=valid%2disrgr...

seba_dos1 8y ago

Works on Nokia N900.