@lestaff will LE Staging be configured to return leaf + 2 intermediate certs (as described in "What exactly is changing?" section of https://letsencrypt.org/2020/12/21/extending-android-compatibility.html ) so we can test before this happens in LE Production? Thanks.

This is an interesting idea, getting a Root-Cross-Sign valid for longer than the Root itself - I didn't knew that Android wasn't validating expiry dates on trust anchors, but it makes sense from a compatibility point of view. I only have one concern: Does this work with other devices, other than An…

My gut instinct is that the "short" chain with just the intermediate is what should be returned by the ACME server, with the alternate being the "long" chain with both the intermediate and the cross-signed ISRG Root X1. It seems to me that the longer chain (purely designed for compatibility with pla…

@petercooperjr The webserver doesn't have any information other than SNI before establishing the TLS handshake unfortunately.

[image] Nummer378: Is this concern valid, or is my assumption about the behavior of old versions of OpenSSL/GnuTLS incorrect? Yep, that's a very valid concern, and one of the things we plan to address in a more technical post, as mentioned at the end of the current post. There are other posts…

and when we have ECDSA CAs it would be DST-> ISRG x1 -> ISRG X2 -> E1 -> leaf? what's really long chain :crazy_face:

[image] aarongable: We thought about this choice for a long time, and while we love the idea of serving the shorter more efficient chain by default, we don't currently think that's the right call. Just adding to this thought, I really think you also need to give client developers at least 2 m…

[image] aarongable: Subscribers who value compatibility with older versions of OpenSSL and GnuTLS over compatibility with older versions of Android will be able to use the alternate chain to get the compatibility they need. Considering that one chooses compatibility with Older Android Devices…

it's what happended at addtrust external ca root expired ( https://crt.sh/?id=4860286 ) but it that case intermediate for it expired too, only thing that was effected by that was old version of openssl and GnuTLS so in effect they minesweeped the field already for us.

What is the best way to find out when you are pushing the changes to Staging and to Production? When you change the intermediate in Production several weeks ago, it broke a lot of my systems, so I need to plan changes at the same time that you make yours.

Questions re: Extending Android Device Compatibility

Issuance Tech

aarongable December 21, 2020, 4:35pm 2

Yes, that's the plan. We hope to have new certificates in Staging, including a longer chain as the default, sometime in January.

Topic		Replies	Views
Questions re: OpenSSL Client Compatibility Changes for Let’s Encrypt Certificates Issuance Tech	52	10421	August 31, 2021
Questions regarding "Shortening the Let's Encrypt Chain of Trust" Help	90	8424	June 10, 2024
Understanding DST Root expiry and the older default cert chain Help	35	3781	November 8, 2021
Help thread for DST Root CA X3 expiration (September 2021) Help	665	169728	December 26, 2021
Older Android devices Issuance Policy	20	7981	May 13, 2021

Questions re: Extending Android Device Compatibility

Related topics