Hacker News new | past | comments | ask | show | jobs | submit login
Extending Android Device Compatibility for Let's Encrypt Certificates (letsencrypt.org)
1 point by nobody9999 on Dec 23, 2020 | hide | past | favorite | 1 comment



Let's Encrypt's solution is to continue the use of the original Identrust cert that cross-signed their original CA cert. Identrust will do so using their expiring cert which, due to Android's certificate policy should work.

From TFA[0]: "IdenTrust has agreed to issue a 3-year cross-sign for our ISRG Root X1 from their DST Root CA X3. The new cross-sign will be somewhat novel because it extends beyond the expiration of DST Root CA X3. This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors. ISRG and IdenTrust reached out to our auditors and root programs to review this plan and ensure there weren’t any compliance concerns."

[0] https://letsencrypt.org/2020/12/21/extending-android-compati...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: