Let's Encrypt's old root expired. The fix for old phones was a trap for old OpenSSL.

transcript

A third of Android devices were headed for warnings on Let's Encrypt sites. The fix was a loophole. And the loophole had a trap.

Your browser trusts a site through a chain. It ends at a root on your device. Let's Encrypt's own root, ISRG Root X1, started out brand new. Devices didn't trust it yet. So it borrowed trust. From an old IdenTrust root every big platform trusted. The catch? That old root expired on 30 September 2021.

Most devices trusted the new root by then. Not phones that never update. By September 2020 figures, 33 point 8 percent of Android devices still didn't.

Then came a loophole. Old Android doesn't check if a stored root expired. So IdenTrust signed a new cross-certificate. Valid until early 2024.

The chain grew one link longer. Old Android kept working. But here's the trap. Old OpenSSL, version 1 point 0, chokes on that chain. Even when it trusts the new root. API clients had to upgrade.

And some devices never get software updates. Let's Encrypt's examples? An iPhone 4. An HTC Dream. They will never trust the new root.

Know which roots your clients depend on. Test old clients early. Because a fix for one group can break another.

Full story in the article.