"I use an old Android device, what do I need to do? Nothing! We’re trying to ensure that this change is completely invisible to end-users."
Well, this seems not to work with my Android 4.4 phone. There are several sites with Let's Encrypt certificates that are unreachable since October, the perhaps most well-known being stackoverflow.com.
Do you have examples of sites not working? And also please show the corresponding error message in Android, preferably with a screenshot.
It's possible that site operators have decided not to implement the Android pre-7.1 compatibility. I.e.: don't use the default certificate chain but intentionally chose the alternative chain.
That should not be necessary if the server uses the default "Android compatibility" chain. Of course the DST Root CA X3 should be available to Android and not be deleted to retain that compatibility.
If the server indeed uses the non-default, alternative chain without the Android compatibility, then manually installing the ISRG Root X1 root certificate might indeed help.
We recently learned that stackoverflow.com (and example given in original post) uses the long chain but only with proper SNI host name. Without that it sends a faulty cert. Someone was going to contact them but seems like a problem still
They're just intended for testing, whereas testing with something like stackoverflow might surface other problems. (Like I don't think Stack Overflow supports TLS 1.0, whereas I think old Android doesn't support TLS 1.2)
Another test site that might be helpful to see the output of:
Well, that's very odd (and stupid).. Why would someone send an ancient certificate chain and expired end leaf certificate for non-SNI connections? (Rhetorical question.)
Also, Android 4.4 should support SNI. At least, the Android browser does, according to a random site I googled...
Does that "default browser" work on https://helloworld.letsencrypt.org? I have a hunch that the issue with old devices like this is mainly about TLSv1.0 going away industry-wide, rather than anything root/trust related.
