Skip to main content

Got an older Android phone? You may soon get locked out of a lot of top websites

Android phones
(Image credit: Pixabay)
Audio player loading…

A large number of websites and online applications may begin malfunctioning or even fail to load entirely on older Android devices - those running Android 7.1 or earlier - from early next year due to an SSL certification (opens in new tab) issue. 

The problem revolves around a cross-certification held by Let’s Encrypt that is due to expire. Essentially, when a new certification authority is established, it often seeks a cross-signature from an authority that is already established. This is what happened when Lets Encrypt started out in 2016, when it secured a cross-signature against IdenTrust's DST Root X3 certificate. 

That partnership is set to expire on September 1, 2021 and now that Let’s Encrypt is well-established, it doesn’t intend on renewing.

This means that any browsers and operating systems that don’t accept Let’s Encrypt’s root certificate (so any that relied on the ongoing partnership with IdenTrust for approval) will not be compatible with services that continue to use Let’s Encrypt certificates.

Android clock is ticking

Although the agreement between Let’s Encrypt and IdenTrust doesn’t expire until September, Let’s Encrypt will stop cross-signing by default on January 11, 2021. So online services could start misbehaving pretty soon.

“Currently, 66.2% of Android devices are running version 7.1 or above,” Jacob Hoffman-Andrews, lead developers at Let’s Encrypt, explained (opens in new tab)

“The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let’s Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant.”

As Hoffman-Andrews explains, hopefully the certification issue won’t prove overly disruptive. If legacy Android users don’t want to upgrade, they could install the Firefox browser, as this uses its own certification store that includes the Let’s Encrypt root certificate. 

However, services that exist outside the browser may still malfunction.

Via Android Police (opens in new tab)

Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services.  After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things.