Impact of Let's Encrypt changes in Discourse users on old Android versions

Product Support Self-hosting

AI-generated summary

A change by Let’s Encrypt will cause issues for Discourse users on Android versions prior to 7.1.1, affecting their ability to connect using Google Chrome as of January 11, 2021. According to Let’s Encrypt, this could impact up to 33.8% of Android users, but a quick check by Falco showed the number to be closer to 3% in their hosting.

A workaround is using Firefox for Android, which is supported in 97% of the affected users. Falco also mentioned that users can test if they will be affected by visiting a specific website.

Codinghorror initially suggested increasing the minimum supported Android version to 7.1.2 as of January 11, 2021, but this was later rendered unnecessary due to an update by Let’s Encrypt.

Ljpp suggested using Cloudflare as a potential solution, and Falco confirmed that using any other certificate authority, including Cloudflare, would be a way around the issue.

However, Falco later shared an update from Let’s Encrypt, stating that they will be extending compatibility for older Android versions. As a result, codinghorror noted that while the Discourse Hub app will still require Android 7.1.2 or later, accessing a Discourse site via the browser should be okay on older versions of Android, provided the user has an updated browser.

1

Last week, the default certificate authority for Discourse announced an incoming change for next year, you can read it in details here:

What that means in the current status of Discourse is that from 2021-01-11T03:00:00Z users on Android version prior to 7.1.1 will be unable to connect to Discourse using Google Chrome. This can be postponed to September if we change how the certificate is requested, but it’s not something we have ready nor planned.

While the blog post shows that this can be a big as 33,8% of the Android users, doing a quick check on the last hour of some our hosting shows this number to be closer to 3%.

The post also tells that one workaround is using Firefox for Android that ships its own updated certificates. Firefox is supported in 97% of the affected users, as it supports Android 5+. And while we don’t support it officially, we do have some enthusiastic Firefox users on the team that keep an eye for basic usability issues.

Users can test if they will be affected by visiting https://valid-isrgrootx1.letsencrypt.org/

2

I’m assuming Google Chrome means it also impacts Discourse Hub, and anyone who installed the PWA would be silently broken?

3

Yes, it impacts Discourse Hub and any app that uses the OS certificate store.

We could make Discourse Hub use a different certificate for Android version > 6 and < 7.1.1, but not something we have planned at the moment.

PWAs use the Chrome engine by default, so they are also affected, unless installed using Firefox.

4

It looks like we will move the minimum supported Discourse Android version up to 7.1.2 as of January 11, 2021.

Android 7 was released in August 2016, over 4 years ago.

5

Going to be watching this one with interest. There are a number of <$100 tablets which are still selling with Android 6 and 7. I saw one project in March hand jobseekers hundreds of tablets running 7.1.

In that case the obvious solution will just be to stop using Let’s Encrypt.

6

Well, hopefully they were running 7.1.2 – that seems likely enough if they were on 7.1.

7

I wonder if Cloudflare is a way around this? Websites using their caching report Cloudflare’s certificate, and not the origin’s.

8

Using any other certificate authority is a way around, Cloudflare being one of those.

9

Our partners at Let’s Encrypt contacted us to share the following news:

Looks like old Androids will be able to continue browsing sites using Let’s Encrypt just fine :smiley:

10

Note that Discourse Hub app will still require Android 7.1.2 or later, but this change by Let’s Encrypt means accessing a https Discourse site via the browser should be OK on older versions of Android, provided the user has an updated browser.