A large number of websites and online applications may begin malfunctioning or even fail to load entirely on older Android devices - those running Android 7.1 or earlier - from early next year due to an SSL certification (opens in new tab) issue.
The problem revolves around a cross-certification held by Let’s Encrypt that is due to expire. Essentially, when a new certification authority is established, it often seeks a cross-signature from an authority that is already established. This is what happened when Lets Encrypt started out in 2016, when it secured a cross-signature against IdenTrust's DST Root X3 certificate.
That partnership is set to expire on September 1, 2021 and now that Let’s Encrypt is well-established, it doesn’t intend on renewing.
- Here's our list of the best web hosting services (opens in new tab)
- The best endpoint protection software (opens in new tab) for your business
- Check out our roundup of the best online cybersecurity courses (opens in new tab)
This means that any browsers and operating systems that don’t accept Let’s Encrypt’s root certificate (so any that relied on the ongoing partnership with IdenTrust for approval) will not be compatible with services that continue to use Let’s Encrypt certificates.
Android clock is ticking
Although the agreement between Let’s Encrypt and IdenTrust doesn’t expire until September, Let’s Encrypt will stop cross-signing by default on January 11, 2021. So online services could start misbehaving pretty soon.
“Currently, 66.2% of Android devices are running version 7.1 or above,” Jacob Hoffman-Andrews, lead developers at Let’s Encrypt, explained (opens in new tab).
“The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let’s Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. Hopefully these numbers will be lower by the time DST Root X3 expires next year, but the change may not be very significant.”
As Hoffman-Andrews explains, hopefully the certification issue won’t prove overly disruptive. If legacy Android users don’t want to upgrade, they could install the Firefox browser, as this uses its own certification store that includes the Let’s Encrypt root certificate.
However, services that exist outside the browser may still malfunction.
- And here's our list of the best data protection services (opens in new tab)
Via Android Police (opens in new tab)
