Question on SN-792 LetsEncrypt's new root certificate and old Androids

[Dror Harari]

Does anyone know why can't user manually add the LetsEncrypt new "ISRG Root X1" root CA certificate?

Otherwise can't Google use one of its system apps that are still maintained to install that certificate in old Android devices?

Otherwise, given that old <=v7.1 Android devices have not been patched for years and have an endless selection of rooting options, can't the same be done by a 3rd party - even LetsEncrypt themselves can produce this app and offer it on their site for sideloading (assuming Google does not cooperate) like 0Patch does for Windows.

Since none of those options was discussed by Steve, I am assuming that there's some big problem I am missing. Any idea?

 

[miquelfire]

1) Most (if not all) people running these old versions are NOT able to root their devices for one reason or another, which I lean toward them not being tech savvy so the concept of root is something that IT would do if they heard about it. Those that do know how to root, may not have a need to go down the rabbit hole (assuming the device is still supported enough by the rooting community to bother with that effort). I got annoyed with an old phone that I rooted that I basically had to reinstall the whole OS for every update. Can you imagine Patch Tuesday on Windows if you needed the OS disk to reinstall Windows every month? That's what it felt like using that phone somehow.

2) I think Android might be designed in a way an app can't just add certs to the device at all. If they want to support the new cert, they might be able to run their own CA store (like Firefox...). It's also possible that 7.1 Google added a way to keep the system certs up to date VIA the Play Store, hence why older versions can't be easily updated

 

[PHolder]

It's never easy to add a root certificate in any device, and for good reason. Users can be "talked through" doing things that are very bad for them by persuasive mal-doers... and if you trust the wrong root certificate, you're completely and utterly toast.

 

[Lob]

I would look at this problem in another way. The people with these old devices, if they are shopping or banking (shudder) on their devices, those establishments are not using ACME certs from Let's Encrypt. So the world will spin.

Also these people are not security aware so when a scammer gets them to a site with such a cert, it won't work. Or rather they will chase the whatever-it-is-to-continue button around the screen to get to the site.

We don't know the demographic of these people but like old versions of iPhones, stuck on iOS 6 like my 3gs, the Internet isn't a good place to be anyway.....

 

[Dror Harari]

Thanks for your replies @miquelfire, @PHolder and @Lob - I am fully aware of the risk of folks adding root CA certs without fully understanding what they are doing.

The main thing that bothered me is the notion that Google is not able to install a root CA using its Playstore or other system apps that do not require the phone vendor's cooperation.

 

[PHolder]

Looks like they've come up with a workaround, that involves the cross signing of an expired certificate because apparently Android doesn't validate the expiry on "root trust" certificates.

Let’s Encrypt comes up with workaround for abandonware Android devices

When you haven’t been updated since 2016, expiring certificates are a problem.

arstechnica.com