4 ms·
Original Source, from Let's Encrypt: https://letsencrypt.org/2020/12/21/extending-android-compatibility.html https://letsencrypt.org/2020/12/21/extending-androi
by jefftk 6y ago
Original Source, from Let's Encrypt: https://letsencrypt.org/2020/12/21/extending-android-compatibility.html https://letsencrypt.org/2020/12/21/extending-android-compati...
"IdenTrust has agreed to issue a 3-year cross-sign for our ISRG Root X1 from their DST Root CA X3. The new cross-sign will be somewhat novel because it extends beyond the expiration of DST Root CA X3. This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors."
Thread from when this was originally posted: https://news.ycombinator.com/item?id=25495927 https://news.ycombinator.com/item?id=25495927
- edoceo 6y agoThis "Android intentionally does not enforce the expiration dates of certificates used as trust anchors" - seems like another issue. And now LE is basically building features on an implementation flaw?
- schoen 6y agoI agree with you conceptually, but it seems like everyone wants this and nobody doesn't want it, so as the lawyers sometimes say, "no harm, no foul". In particular, the users of the Android devices want to continue to be able to access sites protected with Let's Encrypt, the site operators want to continue to allow this, Let's Encrypt wants to continue to allow this, and the auditors and root program operators decided that they don't consider it improper either. You're right to describe it as an implementation flaw -- among other things, it removes the lever that root programs normally have to ensure continued compliance by CAs.
- stjohnswarts 6y agoThanks for the explanation. Sometime pragmatism has to overcome idealism/semantics to keep things moving.