Let's Encrypt had IdenTrust cross-sign past its own expiry, keeping old Android online

Ars Technica reported in December 2020 that Let's Encrypt was moving to a standalone certificate authority. To launch quickly it had used a cross-signature from established CA IdenTrust, and in 2016 it also issued its own root, ISRG Root X1. IdenTrust's DST Root X3 was due to expire in September 2021, so the cross-sign would lapse.

Let's Encrypt was added to Android's CA store in version 7.1.1 (December 2016), and 33.8% of active Android users were on older versions, which Ars put at about 845 million people with a root store frozen in 2016. An expired certificate would have broken apps and browsers that use Android's system store.

Let's Encrypt announced that IdenTrust had agreed to issue a three-year cross-sign of ISRG Root X1 from DST Root CA X3, running beyond that root's own expiry. It works because Android intentionally does not enforce expiry dates on trust anchors, which root stores hold as keys rather than full certificates. ISRG and IdenTrust consulted auditors and root programs, and subscribers would get both certificate chains.

Have IdenTrust issue a cross-sign that outlives its own root, as Android never checks trust anchors' expiry dates.

Old Android phones cannot be updated centrally, so a new root could not reach them.

Android's root store treats trust anchors as keys and ignores their notAfter field.

A cross-sign is validated against the anchor's key, so it can outlive the anchor's certificate.

Checking with auditors and root programs confirmed the plan raised no compliance concerns.

Read how the strictest-looking client really validates; a rule it never enforces can be the escape hatch.

The new cross-sign was set to expire in early 2024, by which time Let's Encrypt hoped versions of Android from 2016 and earlier would be gone. As of the article, Android 4.2 had 0.8% of the market. Ars reported the plan as announced; it did not report the September 2021 outcome.