SSL Certificate error.

[Graham G3ZVT]

Seems to have coincided with the start of the month.

Oddly it's only affecting my Android phone, the PC with Chrome browser is unaffected.

[paulsherwin]

There have been some changes around SSL certification which have had some complex ramifications, particularly for older devices which haven't received software updates. This includes some older Android phones and tablets.

See https://www.zdnet.com/article/fortin...crypt-expires/

This isn't really a forum issue, and there isn't anything Paul Stenning or the mods can do to improve matters.

[dsergeant]

So that is it for my old Tesco Hudl1.... As you say, nothing the mods on here can do anything about.

Dave

[kellys_eye]

AFAIK the Tesco Hudl stopped updating Android some years ago and there have been multiple issues with people trying to keep the device working past this 'log jam' - I'm amazed you are still managing to use one!

There were a few methods published online describing how to update to a certain level but even that is well short of the current version needed to keep usability.

I have had issues with SSL errors due to the clock/calendar being wrong so maybe check those settings?

[paulsherwin]

Tesco allowed the SSL certificate to expire on the Hudl provisioning server, and it became impossible to do a factory reset - in fact, resetting a Hudl effectively bricked it because it couldn't establish a connection with the server.

There was a workaround which involved interrupting the boot sequence and resetting the system date to before the SSL certificate expired. The Hudl would then proceed to reinitialise. This would only work if the server was actually still there and the domain name could be resolved.

I don't think that bodge will work with the current problems though, as I think the root certificate in question has actually been revoked rather than expiring normally.

[Graham G3ZVT]

Thanks for the information Paul, now that I know it's not a matter of the forum owner putting a shilling in the meter, I tried removing Chrome which unsurprisingly you can't do, but it did remove some updates and allowed me to reapply new ones.

It seems to have resolved the issue for this Sony Xperia.

Incidentally it was still possible to browse and post to the forum with the error, but on each and every page I needed to press the advanced button in the error message which revealed an option to go to the requested "unsafe" forum page.

[paulsherwin]

Some browsers do allow you to override an SSL certificate error, but I don't think the current version of Chrome does.

A bad root certificate has consequences right across the internet though - it isn't just a matter of getting an error message on your browser.

[Panrock]

Originally Posted by rambo1152

Incidentally it was still possible to browse and post to the forum with the error, but on each and every page I needed to press the advanced button in the error message which revealed an option to go to the requested "unsafe" forum page.

I've been getting this on my Samsung S5, both with Chrome and the native browser. It's very annoying and I don't know what to do.

Steve

[paulsherwin]

What version of Android is it running? I think it originally came with 4.4. You may be able to upgrade to 5 or 6, which may or may not help.

Try uninstalling and reinstalling Chrome.

[Panrock]

Android 5.0. I'll have a play... thanks.

Steve

[paulsherwin]

You should certainly check if any OS updates are available and apply them. Samsung are usually pretty good about supplying Android updates, but the S5 is getting on a bit now.

[Panrock]

Well, I see it's been five years without 'software updates'. Right now it's downloading 52 MB of 'em. We shall see...

Steve

Edit. That should have said 963.52 MB !!!

[paulsherwin]

That's actually good news.

[dsergeant]

An update on my Hudl.
I managed to export the not yet expired ISRGroot.crt certificate from Palemoon and transferred then installed it into the root of my Hudl. PM if you want more details. With this I find Chrome on the Hudl now accesses this site correctly. Firefox for Android which I also have on it uses its own certificate store and I have not yet found how to import the certificate into that. I did think I could just update Firefox to the latest version but unfortunately that is not compatible to my ancient Android and Google Store doesn't even offer it to me.

Dave

[paulsherwin]

Excellent work Dave, thanks for the info.

It may be worth googling for Firefox APKs and trying a few of those.

[Panrock]

Now running Android 'Marshmallow' 6.0.1. and 351 apps updated and the device got quite hot.

Unfortunately the certification problem remains. Though the device is still asking when I want to update the software! I've been twice round this identical loop now.

Steve

[paulsherwin]

Keep going until it stops offering you updates. You may need to reboot.

[Panrock]

It upgrades/optimises the same 311 apps every time... it's now going round a third time. Maybe 5 years worth of updates at once is a bit too much for it to swallow.

I updated Chrome separately to the latest version. Still reports the same error. Rebooted of course.

I'll keep trying.

Steve

[AC/HL]

My S6 (Android7) is the same, although I normally only use the PC for this site. It seems to be OK on other sites, BBC for example.
It's fully updated, but they're quite old now. The old S2 was retired some years ago for the same reason. My Wife is on the treadmill, so I'll be getting an S10 in due course!

[Panrock]

It looks like it just applies to sites on this server.

Steve