{"id":101436,"date":"2021-09-27T16:22:56","date_gmt":"2021-09-27T14:22:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah"},"modified":"2021-09-27T16:22:56","modified_gmt":"2021-09-27T14:22:56","slug":"ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ustarevanie-kornevogo-sertifikata-identrust-privedyot-k-potere-doveriya-k-lets-encrypt-na-staryh-ustrojstvah","title":{"rendered":"The obsolescence of the IdenTrust root certificate will lead to a loss of trust in Let's Encrypt on older devices.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

On September 30 at 17:01 Moscow time, the lifetime of the root certificate from IdenTrust (DST Root CA X3), which was used for cross-signing the root certificate of the Let’s Encrypt Certificate Authority (ISRG Root X1), will expire. This community-controlled certificate grants certificates free of charge to anyone who wishes to obtain them. The cross-signature provided trust to Let’s Encrypt certificates across a wide range of devices, operating systems, and browsers during the integration of its own root certificate into root certificate stores. <\/p>\n

Initially, it was planned that after the expiration of DST Root CA X3, the Let’s Encrypt project would move to signing only with its own root certificate. However, this step would lead to compatibility issues with many older systems that had not added the Let’s Encrypt root certificate to their stores. Specifically, about 30% of currently used Android devices do not have information about the Let’s Encrypt root certificate, which has only been supported since Android platform 7.1.1, released in late 2016. <\/p>\n

Let’s Encrypt did not plan to enter into a new cross-signing agreement, as this adds additional responsibilities to the participants, limits independence, and restricts compliance with all procedures and rules of another certificate authority. However, due to potential issues arising on many Android devices, the plan was reconsidered. A new agreement was established with IdenTrust, which created an alternative cross-signed intermediate certificate for Let’s Encrypt. The cross-signature will be valid for three years and will help maintain support for Android devices starting from version 2.3.6. <\/p>\n

Nevertheless, the new intermediate certificate does not cover many other outdated systems. For instance, after the expiration of the DST Root CA X3 certificate on September 30, Let’s Encrypt certificates will stop being recognized in unsupported firmware and operating systems, where manual addition of the ISRG Root X1 certificate to the root certificate store will be required to establish trust in Let’s Encrypt certificates. Issues will manifest in: <\/p>\n