Hacker News Reader

Comment by heavyset_go | Hacker News Reader

And older phones might have certificate stores that can't be upgraded and have already expired.

It’s kinda annoying that I can barely use my 2013 iPad Mini because of this kind of issue, even though I absolutely love that thing (I even used it as my primary smartphone using voip for a few years!).

I know Google tried to address this by giving Chrome its own independently upgradable certificate store and thought Apple would do something similar, especially since they don't have to rely on OEMs to push system updates.

Are you sure that's the issue, and not cipher/protocol support? The root CA needed for lets encrypt is "DST Root CA X3" which is supported by iOS 7 https://support.apple.com/en-ca/HT203065 (and has a validity start date in 2000, so i imagine goes earlier). Now there are lots of other CAs, but lets encrypt is probably the most popular, i would be kind of surprised that the root certificate store is the limiting factor as opposed to not supporting any GCM ciphers

if it's a limited number of Root CA certs that are not supported, you can likely install those manually.

I have the same problem with a BlackBerry Playbook tablet - great form factor but it doesn’t handle websites using modern SSL.

I believe you can work around this using another machine as an SSL proxy - though setting that up is beyond my ability. Perhaps someone else can elaborate?

Indeed, proxies can work around the problem. I made this for Macs, but you could run it on a Mac and connect from a Playbook, or set up Squid yourself on a Raspberry Pi. https://jonathanalland.com/legacy-mac-proxy.html

I’ve used Squid as a filtering proxy in the past. Unfortunately, I don’t have a Mac, but this:

https://dev.to/suntong/squid-proxy-and-ssl-interception-1oa4

- looks like it might be a useful guide for setting it up as an SSL proxy.

Or the server only accepts modern ciphers or TLS.

I took a deep dive into this after I was unable to access my blog on my iOS 6 device. I concluded that I don't really need a ssllab's A. It is much more likely someone will try visiting my blog with a older device than someone will MITM one of the visitors.

https://blog.nyman.re/2021/02/07/usability-security.html

Interesting write up, thanks for sharing it.

Reply on news.ycombinator.com