# Let's Encrypt certificates fail on Android before 7.1.1

> Android versions before 7.1.1 do not trust ISRG Root X1, so Let's Encrypt sites fail on them since the cross-sign ended in 2024. Options for users and owners.

Source: https://ssl.sh/errors/old-android-lets-encrypt-error/
Last updated: 2026-11-10

**On Android 7.0 and earlier, sites with Let's Encrypt certificates fail because those devices do not include the ISRG Root X1 root certificate.** A cross-signature from an older root hid the problem until that chain expired on 30 September 2024. Old phones now show a certificate authority error in the browser and most apps.

## Is it the site or your device?

It is the device: the site's chain is valid, but old Android lacks the root. Test the site with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

If it passes, and the issuer is Let's Encrypt, the problem is the device's age. Confirm by opening Settings > About phone: Android 7.1.1 or later should work. Visitors with older phones can use a browser that ships its own root store (Firefox has historically done so on Android, where a version for the device is still offered), but the long-term answer is a supported device.

## Causes

### 1. Root not present on the device

Android 7.1.1 added ISRG Root X1. Earlier versions only trust roots shipped with them and, without updates, never receive new ones.

### 2. The DST Root CA X3 cross-signature ended

Let's Encrypt kept old Android working with a chain through DST Root CA X3, relying on Android not checking root expiry. Let's Encrypt stopped serving that chain by default in 2024 and the cross-signed certificate expired on 30 September 2024. Check the chain your server sends:

```bash
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E "^ *[0-9] s:|i:"
```

### 3. Apps using the platform trust store

Most Android apps use the system's roots. On an old device they fail with [Trust anchor for certification path not found](https://ssl.sh/errors/android-trust-anchor-not-found/), even if a bundled browser works.

### 4. Embedded and long-life devices

TV boxes, point-of-sale terminals, kiosks and car head units often run old Android and cannot be updated, making this a business problem rather than a consumer one.

## What it looks like on each device

| Device | What you see |
|---|---|
| Android 7.0 or earlier, Chrome or system browser | "Your connection is not private" with `NET::ERR_CERT_AUTHORITY_INVALID` |
| Android 7.0 or earlier, apps | `Trust anchor for certification path not found` |
| Android 7.1.1 or later | Works normally |
| Desktop browsers | Work normally |

## How site owners fix it

The server cannot add a root to old phones; owners either accept the loss or serve those devices from a hostname with a compatible chain.

**1. Decide whether you must support old devices.** Check analytics for Android versions below 7.1.1. Often the share is small, but kiosks or partner devices may matter.

**2. Use a CA with a compatible chain** for the hostnames those devices use (for example a dedicated API hostname). Review each CA's compatibility page and test on a real old device, then verify with `curl ssl.sh/example.com` and the [chain builder](https://ssl.sh/tools/chain-builder/).

**3. For your own apps,** bundle ISRG Root X1 alongside the system roots. On Android 7.0 use a network security config; for Android 6 and earlier, use a TrustManager built from the system roots plus the bundled root (for example OkHttp's `HandshakeCertificates` with platform certificates added), never a trust-all manager.

**4. Track root changes** on the [Let's Encrypt timeline](https://ssl.sh/timeline/lets-encrypt/) so future chain changes do not surprise you.