Let's Encrypt on Android Devices with Older Browsers

[sahsanu]

Hi @ahaw021,

@ahaw021

IIS is smart enough to use the correct certificate to include in the chain even if non relevant Intermediates are installed.

It seems not so smart enough regarding the previous and long post IIS 8.5 building incorrect chain with Lets Encrypt Authority X3

@ahaw021

Also the correct intermediate is now being served SSL Server Test: ebank.reb.sy (Powered by Qualys SSL Labs)

Well, it is and it isn't ;), right now it is serving the intermediate certificate for Let's Encrypt Authority X3 BUT issued by ISRG Root X1 instead of the one issued by DST Root CA X3. As far as I know ISRG Root X1 is not included yet in Android, at least it is not in my Android version 7.0.

@allam, just to test, try to remove the intermediate certificate Let's Encrypt Authority X3 issued by ISRG Root X1 and left only the one issued by DST Root CA X3.

Cheers,
sahsanu