I sometimes use an older phone to browse the web. I've noticed that LE sites just don't load.
It just says "can't establish a secure connection".
Larger sites don't have this problem.
It just says "can't establish a secure connection".
Larger sites don't have this problem.
All larger sites? Wikipedia uses lets encrypt (although it may depend which data center you hit, i think, not sure). Stack overflow uses lets encrypt.
If its only small sites maybe lets encrypt isn't the problem.
Edit - I stand corrected. Likely I've been confused by a few devices and Linux distros I had that simply broke on that day.
Also, I remember having to manually fix a few Ubuntu servers that day when this happened. Anyone else had that experience around Oct 2021?
Support goes back pretty far.
Edit: this particular device is iPhone 4
In theory you can use MDM to add the LE root cert to your phone's certificate store.
Okay, so Wikipedia says the newest OS for that phone is iOS 7.1.2, which was released June 30, 2014. So you've got a phone with no OS updates, including security patches, in ~8 years. Considering that AFAICT Apple bakes webkit updates into the OS, your browser has not been patched in 8 years. Bluntly, HTTPS certs are the least of the reasons that your device has no business being on the internet.
What a silly statement. Any device any user chooses to has business being on the internet. That's what the world wide web is.
https://letsencrypt.org/2020/12/21/extending-android-compati...
What happened relatively recently was the DST cross sign expired; but any device should, by that point, have received the ISRG root, or you haven't gotten security updates in the last 7 years.
Additionally, there were/are problems with some TLS libraries (e.g., GnuTLS) that have bugs in path building. (Fixes have been made, since LE not working is pretty obvious.) They'll build a path to the expired DST cert, and then conclude (incorrectly) that no other valid path can exist. (When in fact, there is, to LE's own root.)
(Additionally, I've also seen vendors corrupt the ca-certificates directory, and then OpenSSL fails to do path building. This is sort of a pathological case, and probably not your phone's issue.)