Hi,
I have an old android 5.1 device, the only possible to acces HA on it, is to install an chrome .apk app, but i need to use an older 95.x version, because new chrome versions need android 6.0
Now, the issue, in order to make an “add to home screen” from chrome, it needs a valid ssl connection
I have one, i use cloudflare dns, and lets encrypt + nginx, but when i access the page on the android 5.1 device, it still gives me below warning, i think its because of 1.3 , can i setup somewhere that the connection will use tls 1.2 ? Not sure where i need to look, is it in chrome ? in HA? or ?
Check the certificate chain you have on your end. To see if you have the default chain (compatible) or the alternate shorter one wich won’t be compatible.
DST Root CA X3 expired on 9/29/21. I’m not understanding why switching would change anything. Let’s Encrypt’s current guidance on certificate compatibility can be found here. Under “Platforms that trust ISRG Root X1” it lists this:
IdenTrust has agreed to issue a 3-year cross-sign for our ISRG Root X1 from their DST Root CA X3. The new cross-sign will be somewhat novel because it extends beyond the expiration of DST Root CA X3. This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors.
So what you’re saying is by adding --preferred-chain "ISRG Root X1" we’re forcing it to use the shorter chain that doesn’t include the cross-sign? I guess that makes sense. @pergola.fabio can you try running certbot manually with this option and show that your certificate works after that? I can add it but I want to know that it actually fixes the issue.
You’ll need to fill in API_KEY, DOMAIN and EMAIL in the above based on your config. Also if you don’t like any of the file/folder locations I picked feel free to change them.
Afterwards you should find your certificate and key in /ssl/letsencrypt/live/$DOMAIN. Move them from there to where your config expects them to be and restart whatever is serving them up to see if it works.
Oh right its a plugin, the Let’s Encrypt addon installs it in the image, the ssh addon obviously doesn’t have it by default. Run this first then try again:
ok, did a quick test already
command worked now, copy pasted those 2 files in ssl folder, overwriting those other 2 already present
restarted nginx addon, cleared cached from browser
didnt yet tested on android 5 , but in my browser i saw the new certificate active (new date)
but its still X1 ?