Things have been touch-and-go for a while, but it looks like Let’s Encrypt’s transition to an independent certification authority (CA) is not I’m going to break a ton of old Android phones. This was a serious concern earlier due to an expired root certificate, but Let’s Encrypt came up with a solution.
Let’s Encrypt is a fairly new certification authority, but it is also one of the most important in the world. The service has been a major player in the effort to make the entire web run over HTTPS and, as an open and free issuing authority, has gone from zero to 1 billion certificates in just four years. For regular users, the trusted CA list is usually issued by your operating system or your browser provider, so any new CA has a long release that involves adding it to the trusted CA list by each trusted system. operation and browser on Earth, as well as getting updates to the very user. To get up and running quickly, Let’s Encrypt received a cross-signature from an established CA, IdenTrust, so any browser or operating system that trusted IdenTrust could now trust Let’s Encrypt, and the service could begins to issue useful certificates.
When it launched in 2016, Let’s Encrypt also issued its own root certificate (“ISRG Root X1”) and requested that it be trusted by major software platforms, most of which accepted it sometime that year. . Now, a few years later, with the “DST Root X3” IdenTrust certificate set to expire in September 2021, it’s time for Let’s Encrypt to stand on its own and build on its own root certificate. Since this was sent four years ago, surely every operating system compatible with the Web currently in use has received an update with the Let’s Encrypt certificate, right?
This is true for every major operating system, except one. Sitting in the corner of the camera, wearing a headset, is Android, the only major operating system for consumers in the world, which can not be updated centrally by its creator. Believe it or not, there are still quite a few people running a version of Android that hasn’t been updated in four years. Let’s Encrypt says it was added to the Android CA store in version 7.1.1 (released in December 2016) and, according to official Google statistics, 33.8% of active Android users have an older version than this. Given the monthly active user base of 2.5 billion Android, this is 845 million people who have a frozen root store in 2016. Oh, no.
Ron Amadeo
In a blog post earlier this year, Let’s Encrypt sounded the alarm that this was a problem, saying “It’s quite mandatory. We are committed to ensuring that everyone on the planet has secure and confidential communications. We know that the people most affected by the Android update issue are the ones we want to help the most – people who may not be able to buy a new phone every four years. Unfortunately, we don’t expect Android usage numbers to change long before [the cross-signature] expiry. Raising awareness of this change now, we hope to help our community find the best way forward.
An expired certificate would have broken applications and browsers that rely on the CA system of the Android system to verify their encrypted connections. Individual application developers could have switched to a work certificate, and skilled users could have installed Firefox (which provides their own CA store). But a lot of services would still be broken.
Yesterday, Let’s Encrypt announced that it has found a solution that will allow old Android phones to continue ticking, and the solution is to … continue to use the expired IdenTrust certificate? Let’s Encrypt says that “IdenTrust has agreed to launch a 3-year cross sign for ISRG Root X1 from DST Root CA X3. The new cross-sign will be somewhat new as it extends beyond the expiration of the DST Root CA X3. the solution works because Android does not intentionally apply the expiration dates of the certificates used as trusted anchors. ISRG and IdenTrust have contacted auditors and root programs to review this plan and ensure that there are no compliance issues. “
Let’s Encrypt goes on to explain: “The self-signed certificate representing the Root DST CA X3 key pair expires. But operating system root browsers and stores do not contain certificates per se, they contain “trusted anchors”, and certificate verification standards allow deployments to choose whether or not to use the fields on trusted anchors. Android has intentionally chosen not to use the Note field after trusted anchors. Just as our ISRG Root X1 was not added to older trusted Android stores, the DST Root CA X3 was not removed. Therefore, it can issue a cross-sign whose validity extends beyond the expiry of its self-signed certificate without any problems. “
Soon Let’s Encrypt will start providing subscribers with both the ISRG Root X1 and DST Root CA X3 certificates, which it says will provide “uninterrupted services for all users and avoid potential breaches we have been concerned about.”
The new cross sign will expire in early 2024 and hopefully Android versions from 2016 and earlier will be dead by then. Today, your basic example of an eight-year-old Android installation starts with version 4.2, which occupies 0.8% of the market.