What happens is you start getting certificate errors when surfing pages in Google Chrome, the most used browser in the universe (whether that's good, or bad, another story . . .)
Sometimes the web page will load a vanilla http version if you manage to click thru all the security warning messages. Sometimes, you won't be able to view the page at all!
But the bottom line is it's a huge inconvenience and I'm sorry to see the only solution suggested by Let's Encypt is to use Firefox.
That's not a viable solution for most users, nor those locked into the Google Chrome eco system.
Easy to say Bruce, but this Google Nexus 7 tablet, and many Android systems don't have the ability to upgrade to the latest whiz-bang-gee-whiz Android.
Just an aside, accepting an invalid certificate does not mean your communication is unencrypted or falling back to http, it means it's not trusted (because the presented certificate failed to validate). If the browser still says https your communication (with someone) is still encrypted.
Regarding your point, your operating system is now unfortunately obsolete, which is certainly a shame - Android neglected to make their trust store easily updateable in older versions. If you control the website in question you can change to a different CA or you may technically still be able to add a CA certificate to the OS trust store with the right tools. You could investigate updating your operating system via something like https://lineageos.org/ but that may be unlikely for an 11yr old tablet.
I’m sorry for the inconvenience. We do not make this decision lightly, but as a small nonprofit, we can only do so much. Maintaining a cross-sign from another CA is quite a lot of work and expense, and ultimately it only benefits a relatively small number of users on outdated devices not updated by their manufacturer.
It is possible to install our root CA into your device, but we don’t provide instructions because that’s outside the scope of what we as a CA are going to help with.
We suggest installing Firefox because we think it is a likely workaround for many users, and installing applications is usually easy.
While I can understand it's sometimes rather difficult to upgrade some (expensive) devices, you must also understand that those Android 7 devices are probably filled with exploitable vulnerabilities. Therefore it's NOT recommended to keep using these old devices, or at least these old operating systems.
As @webprofusion already mentioned you might be able to install an Open Source Android OS like LineageOS. If you go to that linked site and use the filter to uncheck to hide discontinued devices, you'd see 3 different versions of the Nexus 7. You'd need to build it yourself though.
But the bottom line is: one way or another, it's not recommended to keep using these ancient Android versions for a multiple of reasons, where for me security would be the main one.
Instead of blaming LetsEncrypt, consider these two bits of information:
1- The core issue is that Google - a multi-billion dollar company that sold these commercial devices - dropped support and stopped releasing updates for their devices; and coordinating updates with manufacturers they have partnerships with. The easiest and most correct channel to address this issue – and fix the entire ecosystem – would be for Google and their corporate partners to continue maintenance for the customers who paid them money. Google's planned obsolescence to drive hardware sales is not a problem that people should demand independent non-profits to fix. Complain to Google.
2- The workaround that LetsEncrypt utilized is essentially an abuse of a security flaw in Google's software. The alternate chain worked because Android ignores certificate expiration dates on the root certificates. Whoops. Pretty much the entire commercial and non-profit SSL industry changed code and loosened security measures to support legacy users through this security flaw.
As a final ditch attempt to breathe more life into those old products...
You could setup a proxy with a private, and very long-lived, cert.
And then have all those devices connect to the Internet via that private proxy.
[just make sure that they are all setup to trust the private cert of that proxy]
Wouldn't it just as easy (i.e.: hard) to add ISRG Root X1? Sounds like this proxy idea doesn't really solve anything, but only adds a MitM possibility.
Maybe...
But Ciphers/Protocols will also become a problem too.
The only way to fix all of them is to use your own proxy.
[which controls the cert/cipher/protocol]
I tried the Lineage upgrade for this Nexus 7 tablet last year. (Can't remember which flavor). But, it was painful with super slow performance, so i reverted back to the original Android os which conveniently updated itself to version 6.0.1, where it then stops cold turkey (the updates, that is).
I will explore some of the other options given about updating and/or messing around with the certificate chains when i get enough free nerd time to work thru these things
