Let's Encrypt's old root certificate expired, and a clever fix for old phones set a trap for old OpenSSL.

Your browser trusts a website's certificate because it chains up to a root certificate already stored on your device. When Let's Encrypt started handing out free certificates, its own root, ISRG Root X1, was brand new, and devices didn't trust it yet. So it borrowed trust: its certificates also chained to DST Root CA X3, an older root from IdenTrust that Windows, macOS, Firefox, Android, iOS and Linux already trusted.

That old root had an end date: 30 September 2021. After it, devices that trusted only DST Root CA X3 would start showing certificate warnings. By then most software trusted ISRG Root X1, but not devices that never get updates. In November 2020 Let's Encrypt said that, by figures from September 2020, 33.8% of Android devices ran versions too old to trust its own root.

Then came a loophole. In December 2020 Let's Encrypt explained that "Android has intentionally chosen not to use the notAfter field of trust anchors": old Android doesn't check whether a stored root has expired. So IdenTrust signed a new cross-certificate valid until early 2024, and Let's Encrypt's default chain grew one link longer, ending at the old root. Old Android devices, it said, would keep working.

The catch was elsewhere. Let's Encrypt warned that in OpenSSL 1.0.x, an older version of a widely used library for secure connections, "a quirk in certificate verification means that even clients that trust ISRG Root X1 will fail when presented with the Android-compatible certificate chain". The fix for old phones was a trap for old software: anyone calling an API from OpenSSL 1.0.x had to upgrade to 1.1.0 or later.

And some devices would never trust the new root at all, because they don't get software updates. Let's Encrypt's examples: "an iPhone 4 or an HTC Dream".

Why it matters: Trust on the internet has expiry dates baked in. Know which roots your clients depend on, test old clients before a root expires, and remember a workaround for one group of clients can break another.