5 ms·

I sometimes use an older phone to browse the web. I've noticed that LE sites just don't load. It just says "can't establish a secure connection". Larger sites

I sometimes use an older phone to browse the web. I've noticed that LE sites just don't load. It just says "can't establish a secure connection". Larger sites don't have this problem.

sgt 4y ago
I'm not sure about the exact year, but I doubt LE will work for devices before 2018. I think they changed their root cert at some point relatively recent. Edit - I stand corrected. Likely I've been confused by a few devices and Linux distros I had that simply broke on that day. Also, I remember having to manually fix a few Ubuntu servers that day when this happened. Anyone else had that experience around Oct 2021?
- JonathonW 4y ago
  The big transition happened in October 2021-- that's when Let's Encrypt's root stopped being cross-signed by IdenTrust (allowing older devices that had the IdenTrust root but not the ISRG/Let's Encrypt root to still validate Let's Encrypt certs): https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/
  - sgt 4y ago
    I corrected my message - but I am still pretty sure that some of our Ubuntu servers broke that day, despite having been updated. Unfortunately I can't remember the details. Good to know that this didn't affect most phones etc.
- chedabob 4y ago
  https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/ Support goes back pretty far.
  - sourcecodeplz 4y ago
    Not far enough it seems, the link you posted has the same problem. Edit: this particular device is iPhone 4
    - selcuka 4y ago
      How old is your phone? Android v2.3.6 and iPhone 5 are supported, which are pretty old.
    - bawolff 4y ago
      So according to the link, you would have to have android 2.3.5 or earlier for it not to work (circa 2010. The final release of that branch was 2.3.7 which should work but maybe your phone provider didnt provide updates for your phone)
    - lilyball 4y ago
      It looks like iPhone 4 runs up to iOS 7.1.2, and according to the above link, LE now requires iOS 10 or later. In theory you can use MDM to add the LE root cert to your phone's certificate store.
    - yjftsjthsd-h 4y ago
      > this particular device is iPhone 4 Okay, so Wikipedia says the newest OS for that phone is iOS 7.1.2, which was released June 30, 2014. So you've got a phone with no OS updates, including security patches, in ~8 years. Considering that AFAICT Apple bakes webkit updates into the OS, your browser has not been patched in 8 years. Bluntly, HTTPS certs are the least of the reasons that your device has no business being on the internet.
      - TheHappyOddish 4y ago
        > Bluntly, HTTPS certs are the least of the reasons that your device has no business being on the internet. What a silly statement. Any device any user chooses to has business being on the internet. That's what the world wide web is.
- bawolff 4y ago
  I dont think that's true. People originally thought that was going to happen due to the root certificate expiring in old android devices, but turns out android does not enforce expiration on roots, so everything ended up ok. https://letsencrypt.org/2020/12/21/extending-android-compatibility.html https://letsencrypt.org/2020/12/21/extending-android-compati...
- deathanatos 4y ago
  No, they didn't. What happened relatively recently was the DST cross sign expired; but any device should, by that point, have received the ISRG root, or you haven't gotten security updates in the last 7 years. Additionally, there were/are problems with some TLS libraries (e.g., GnuTLS) that have bugs in path building. (Fixes have been made, since LE not working is pretty obvious.) They'll build a path to the expired DST cert, and then conclude (incorrectly) that no other valid path can exist. (When in fact, there is, to LE's own root.) (Additionally, I've also seen vendors corrupt the ca-certificates directory, and then OpenSSL fails to do path building. This is sort of a pathological case, and probably not your phone's issue.)
  - deleted 4y ago
    [deleted]
bawolff 4y ago
> Larger sites don't have this problem. All larger sites? Wikipedia uses lets encrypt (although it may depend which data center you hit, i think, not sure). Stack overflow uses lets encrypt. If its only small sites maybe lets encrypt isn't the problem.
- sourcecodeplz 4y ago
  Yes, Wikipedia sadly doesn't work for me on this device.

I sometimes use an older phone to browse the web. I've noticed that LE sites just don't load. It just says "can't establish a secure connection". Larger sites don't have this problem.

sgt 4y ago

I'm not sure about the exact year, but I doubt LE will work for devices before 2018. I think they changed their root cert at some point relatively recent. Edit - I stand corrected. Likely I've been confused by a few devices and Linux distros I had that simply broke on that day. Also, I remember having to manually fix a few Ubuntu servers that day when this happened. Anyone else had that experience around Oct 2021?

JonathonW 4y ago
The big transition happened in October 2021-- that's when Let's Encrypt's root stopped being cross-signed by IdenTrust (allowing older devices that had the IdenTrust root but not the ISRG/Let's Encrypt root to still validate Let's Encrypt certs): https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/
- sgt 4y ago
  I corrected my message - but I am still pretty sure that some of our Ubuntu servers broke that day, despite having been updated. Unfortunately I can't remember the details. Good to know that this didn't affect most phones etc.
chedabob 4y ago
https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/ Support goes back pretty far.
- sourcecodeplz 4y ago
  Not far enough it seems, the link you posted has the same problem. Edit: this particular device is iPhone 4
  - selcuka 4y ago
    How old is your phone? Android v2.3.6 and iPhone 5 are supported, which are pretty old.
  - bawolff 4y ago
    So according to the link, you would have to have android 2.3.5 or earlier for it not to work (circa 2010. The final release of that branch was 2.3.7 which should work but maybe your phone provider didnt provide updates for your phone)
  - lilyball 4y ago
    It looks like iPhone 4 runs up to iOS 7.1.2, and according to the above link, LE now requires iOS 10 or later. In theory you can use MDM to add the LE root cert to your phone's certificate store.
  - yjftsjthsd-h 4y ago
    > this particular device is iPhone 4 Okay, so Wikipedia says the newest OS for that phone is iOS 7.1.2, which was released June 30, 2014. So you've got a phone with no OS updates, including security patches, in ~8 years. Considering that AFAICT Apple bakes webkit updates into the OS, your browser has not been patched in 8 years. Bluntly, HTTPS certs are the least of the reasons that your device has no business being on the internet.
    - TheHappyOddish 4y ago
      > Bluntly, HTTPS certs are the least of the reasons that your device has no business being on the internet. What a silly statement. Any device any user chooses to has business being on the internet. That's what the world wide web is.
bawolff 4y ago
I dont think that's true. People originally thought that was going to happen due to the root certificate expiring in old android devices, but turns out android does not enforce expiration on roots, so everything ended up ok. https://letsencrypt.org/2020/12/21/extending-android-compatibility.html https://letsencrypt.org/2020/12/21/extending-android-compati...
deathanatos 4y ago
No, they didn't. What happened relatively recently was the DST cross sign expired; but any device should, by that point, have received the ISRG root, or you haven't gotten security updates in the last 7 years. Additionally, there were/are problems with some TLS libraries (e.g., GnuTLS) that have bugs in path building. (Fixes have been made, since LE not working is pretty obvious.) They'll build a path to the expired DST cert, and then conclude (incorrectly) that no other valid path can exist. (When in fact, there is, to LE's own root.) (Additionally, I've also seen vendors corrupt the ca-certificates directory, and then OpenSSL fails to do path building. This is sort of a pathological case, and probably not your phone's issue.)
- deleted 4y ago
  [deleted]

bawolff 4y ago

> Larger sites don't have this problem. All larger sites? Wikipedia uses lets encrypt (although it may depend which data center you hit, i think, not sure). Stack overflow uses lets encrypt. If its only small sites maybe lets encrypt isn't the problem.

sourcecodeplz 4y ago
Yes, Wikipedia sadly doesn't work for me on this device.