Root cert problems on AppSupport 4.4.4

I know it’s mostly museum computing, but my JollaC still works pretty well. (Admittedly I have never used as my primary phone, but for reading news and similar at home, which probably contributed to its good condition.)

Recently I have noted that there are more and more connectivity problems in Android. I looked with tcpdump and it seems like the TLS handshake failed. So I guess this might have to do with recent Let’s Encrypt changes. Originally announced at Extending Android Device Compatibility for Let's Encrypt Certificates - Let's Encrypt. I understood support for old Android devices has ended this summer.

So do I have any options except retiring the fine device?

Installing an updated root cert? How? I could find instructions for the new AppSupport, but not for the old one. Unless I tested incorrectly it seems that installing a root cert to the native side does not change anything in the Android side.

Because I use the device only at home I could also connect via my own http proxy. But I could not find any way to set a proxy globally. According to instructions on the web adb shell settings put global ... should allow to set a global proxy. I get it working until adb shell, but the settings binary or built-in does not seem to exist in AppSupport. Maybe related to the fact that com.android.settings does not exist either in the old version?

But probably the proxy would not really help. I still need to make it trusted, so I am back to installing a new root cert. Of course I would use either self-signed or Let’s Encrypt. Don’t want to buy a cert.

There is no difference between 4.5 and 4.6. Not overly surprising, the old AppSupport does not get any updates.

I believe I figured it out:

  1. Download the ISRG X1 root cert in PEM format from Chains of Trust - Let's Encrypt

  2. Call openssl x509 -in ~/Downloads/isrgrootx1.pem -subject_hash_old | head -1 to get a 8 character hash value

  3. Rename the downloaded file mv -i ~/Downloads/isrgrootx1.pem /tmp/<hash>.0

  4. Install the renamed file on the device under /opt/alien/system/etc/security/cacerts/ (devel-su needed)

I made only one quick test because it’s getting late here. But it seemed to work.

2 Likes