This is a community-edited list of which operating systems / browsers can connect to servers that use Let’s Encrypt certificates. More specifically, these systems trust the IdenTrust “DST Root CA X3” certificate that cross-signs ISRG’s issuing certificates. Android >= 2.3.6 (“DST Root CA X3” is inc…

Typically the oldest extant CAs are the most widely trusted. This is because the root application processes for all the major trust stores except Mozilla’s are largely opaque and can take a very long time to complete (Apple is rumoured to be worst), and because once active support for software or ha…

[image] tialaramex: crt.sh | CA:16418 shows that for Microsoft, Mozilla and Apple the current Let's Encrypt issuer, X3, is indeed trusted as you'd expect. Okay, but why on hell does Apple trust LE certs for code signing and secure email (the latter also Microsoft trusts)? LE does not offer an…

Because the DST root is trusted for those purposes and the intermediate does not have any EKU constraints.

As I understand it Apple don’t have a very fine-grained trust system unlike Microsoft. Remember that crt.sh is only a service from Rob at Comodo, it’s not an official communication of any trust store’s policies, and Apple might internally have some mechanism that makes certificates issued by LE not …

[image] tialaramex: As I understand it Apple don't have a very fine-grained trust system unlike Microsoft Orly? [image]

[image] cool110: the intermediate does not have any EKU constraints and this is one of the problems in the CA system (well rather with how it's used in the real world rather than the system itself), many certs dont get restraint where they should, beacuse if someone would be able to get a fra…

In order to implement the standard clients verifying a code signing certificate should verify that the code signing EKU is present in the certificate. As Let’s Encrypt does not issue these certificates (as long as clients implement the standard correctly) there is no real risk of code signed by a Le…

but it still should be constrained because IF anything bad happens (greetings from murphy’s law) and if such a cert appears it will be quite a problem because offline systems cant verify its revocation status.

It should be noted that the Windows XP support requiring Windows XP Service Pack 3 means that only one (x86-32) of the three (x86-32, IA-64/Itanium, x86-64) architectures for which Windows XP was released is supported because Windows XP Service Pack 3 was released only for x86-32.

Some good year-end news: Let’s Encrypt is now recognized/supported by BlackBerry 10 as of version 10.3.3 .

Which browsers and operating systems support Let's Encrypt

Server

Topic		Replies	Views
[Help needed] Windows XP support	117	38795	March 28, 2016
Certificates are not trusted on Chrome and Safari on old iMac with El Capitan Help	52	34966	October 11, 2021
PLEASE cross-sign with another older CA before the 9/2021 deadline Feature Requests	21	4452	April 25, 2021
Users of older Android and Windows 7 not able to access website Help	25	11021	November 2, 2021
Please update the "Certificate Compatibility" page to include information about the new ISRG roots Site Feedback	22	3925	June 21, 2019

Which browsers and operating systems support Let's Encrypt

Related topics