Upcoming Let's Encrypt cert chain change and impact for Cloudflare customers

blog.cloudflare.com

20 pointsspeckx4 comments

In the Let's Encrypt blog post [1] they suggest installing Firefox:

> If you use Android 7.0 or earlier, you may need to take action to ensure you can still access websites secured by Let’s Encrypt certificates. We recommend installing and using Firefox Mobile, which uses its own trust store instead of the Android OS trust store, and therefore trusts ISRG Root X1.

[1] https://letsencrypt.org/2023/07/10/cross-sign-expiration.htm...

Alternatively, take ownership of your system's cert store!

Bonus points: you can evict random pointless roots in order to be informed which sites sign with which CA's!

...Maybe I'm the only one masochistic enough to do it. But I'm nosey about things like that.

What surprising roots have you found in use? Feels like the majority of sites I come across use one of a small handful.

made a video to explain the concept easily https://www.youtube.com/watch?v=yECKKA44YJA

Reply on news.ycombinator.com