How do I check my phone's Android version?

Open Settings > About phone and look for Android version. If it is 7.0 or lower, Let's Encrypt sites will not be trusted by the system browser or most apps.

Can I install ISRG Root X1 myself on an old phone?

You can install it as a user certificate, and the system browser may then accept Let's Encrypt sites. On Android 7.0 apps still ignore user certificates by default. Only download the root from Let's Encrypt's official site. An unsupported phone also misses many other security fixes.

Will switching CA fix it for all old devices?

Only if the new CA's chain ends at a root that those devices already trust. Check each CA's compatibility documentation, and test on the oldest device you need to support before switching.

Let's Encrypt certificates fail on Android before 7.1.1

On Android 7.0 and earlier, sites with Let's Encrypt certificates fail because those devices do not include the ISRG Root X1 root certificate. A cross-signature from an older root hid the problem until that chain expired on 30 September 2024. Old phones now show a certificate authority error in the browser and most apps.

Is it the site or your device?

It is the device: the site's chain is valid, but old Android lacks the root. Test the site with the SSL checker:

curl ssl.sh/example.com

If it passes, and the issuer is Let's Encrypt, the problem is the device's age. Confirm by opening Settings > About phone: Android 7.1.1 or later should work. Visitors with older phones can use a browser that ships its own root store (Firefox has historically done so on Android, where a version for the device is still offered), but the long-term answer is a supported device.

Causes

1. Root not present on the device

Android 7.1.1 added ISRG Root X1. Earlier versions only trust roots shipped with them and, without updates, never receive new ones.

2. The DST Root CA X3 cross-signature ended

Let's Encrypt kept old Android working with a chain through DST Root CA X3, relying on Android not checking root expiry. Let's Encrypt stopped serving that chain by default in 2024 and the cross-signed certificate expired on 30 September 2024. Check the chain your server sends:

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E "^ *[0-9] s:|i:"

3. Apps using the platform trust store

Most Android apps use the system's roots. On an old device they fail with Trust anchor for certification path not found, even if a bundled browser works.

4. Embedded and long-life devices

TV boxes, point-of-sale terminals, kiosks and car head units often run old Android and cannot be updated, making this a business problem rather than a consumer one.

What it looks like on each device

Device	What you see
Android 7.0 or earlier, Chrome or system browser	"Your connection is not private" with `NET::ERR_CERT_AUTHORITY_INVALID`
Android 7.0 or earlier, apps	`Trust anchor for certification path not found`
Android 7.1.1 or later	Works normally
Desktop browsers	Work normally

How site owners fix it

The server cannot add a root to old phones; owners either accept the loss or serve those devices from a hostname with a compatible chain.

1. Decide whether you must support old devices. Check analytics for Android versions below 7.1.1. Often the share is small, but kiosks or partner devices may matter.

2. Use a CA with a compatible chain for the hostnames those devices use (for example a dedicated API hostname). Review each CA's compatibility page and test on a real old device, then verify with curl ssl.sh/example.com and the chain builder.

3. For your own apps, bundle ISRG Root X1 alongside the system roots. On Android 7.0 use a network security config; for Android 6 and earlier, use a TrustManager built from the system roots plus the bundled root (for example OkHttp's HandshakeCertificates with platform certificates added), never a trust-all manager.

4. Track root changes on the Let's Encrypt timeline so future chain changes do not surprise you.