{"id":153283,"date":"2024-08-30T16:39:04","date_gmt":"2024-08-30T21:39:04","guid":{"rendered":"https:\/\/wpengine.com\/?p=153283"},"modified":"2025-11-25T10:08:00","modified_gmt":"2025-11-25T16:08:00","slug":"upcoming-changes-lets-encrypt-chain-of-trust","status":"publish","type":"post","link":"https:\/\/wpengine.com\/resources\/upcoming-changes-lets-encrypt-chain-of-trust\/","title":{"rendered":"Understanding Upcoming Changes to Let\u2019s Encrypt\u2019s Chain of Trust"},"content":{"rendered":"\n

At WP Engine, we\u2019re committed to ensuring your websites are always secure and easy to access. To this end, we use Let’s Encrypt SSL Certificates<\/a> to safeguard the communication between your site and its visitors, providing peace of mind that your digital presence is well-protected. <\/p>\n\n\n\n

Let\u2019s Encrypt remains a leader in SSL protection, providing SSL certificates to more than 260 million websites worldwide. However, we wanted you to be aware of significant changes<\/a> coming to its chain of trust<\/a> hierarchy, which could impact older devices and operating systems.<\/p>\n\n\n\n

The impacts of these changes are expected to be minimal, but understanding how they might affect your site is important for maintaining uninterrupted service and trust with your site users. <\/p>\n\n\n\n

Read on for a quick breakdown of what you need to know. <\/p>\n\n\n\n

What\u2019s a chain of trust?<\/strong><\/h2>\n\n\n\n

A chain of trust<\/a> is a fundamental concept in cybersecurity that ensures each component in a system\u2014whether it\u2019s hardware or software\u2014can be trusted. <\/p>\n\n\n\n

\"Understanding<\/figure>\n\n\n\n

In relation to SSL\/TLS certificates<\/a>, the chain of trust starts with a trusted root certificate authority (CA) at the top and extends through intermediate certificates down to the SSL certificate installed on your site. <\/p>\n\n\n\n

Each certificate in the chain is verified by the one above it, creating a secure link back to the trusted root. This process ensures the SSL certificate used by your site is authentic and can be trusted by users’ browsers and devices.<\/p>\n\n\n\n

In some cases, particularly when a new CA is introduced, its root certificate might not yet be widely trusted by older devices and systems. To address this, a cross-signing method<\/a> can be used, where an established CA vouches for the new CA by signing its certificate.<\/p>\n\n\n\n

This creates an additional link in the chain of trust, allowing older devices to recognize and trust the new CA\u2019s certificates. Cross-signing was particularly useful in the years following Let\u2019s Encrypt’s launch, as it ensured older Android devices could trust its certificates, preventing disruption <\/a>for those users.<\/p>\n\n\n\n

Over time, this approach helped increase the percentage of Android devices capable of natively trusting Let\u2019s Encrypt\u2019s certificates from around 60% to over 93%, significantly reducing the need for cross-signing as newer devices became compliant.<\/p>\n\n\n\n

What\u2019s changing with Let\u2019s Encrypt\u2019s chain of trust? <\/strong><\/h2>\n\n\n\n

In June 2024, Let\u2019s Encrypt announced<\/a> it was discontinuing access to its cross-signed chain, in preparation for the expiration of its cross-signed certificate, on September 30, 2024. <\/p>\n\n\n\n

Both have long extended Let\u2019s Encrypt\u2019s chain of trust to older devices and operating systems that rely on legacy methods to validate SSL certificates. However, the need for cross-signing has diminished in recent years, especially as the percentage of compliant Android devices (capable of natively trusting Let\u2019s Encrypt\u2019s ISRG Root X1 certificate<\/a>) has risen to over 93%.<\/p>\n\n\n\n

The remaining 7% represent unpatched, often unsafe Android devices, and Let\u2019s Encrypt\u2019s decision to shorten the chain of trust is indeed aimed at enhancing privacy and security. By phasing out the cross-signed chain, Let\u2019s Encrypt aims to streamline the trust process, reducing potential vulnerabilities associated with maintaining support for outdated systems.<\/p>\n\n\n\n

While this update will improve efficiency and security for most users, it could result in some older, unpatched devices no longer recognizing Let\u2019s Encrypt certificates, leading to potential access issues. <\/p>\n\n\n\n

For the vast majority of users on modern devices, the impact will be negligible. However, it\u2019s important to assess whether your audience includes users on older devices and, if so, to consider potential mitigation strategies.<\/p>\n\n\n\n

This is because these older systems may no longer recognize the certificates issued by Let\u2019s Encrypt without the cross-signed chain, leading to potential security warnings or blocked access. <\/p>\n\n\n\n

Again, the effects of this change will be negligible for most websites. However, it\u2019s important to assess whether your audience includes users who may be on older devices and, if so, what potential mitigation strategies might be.<\/p>\n\n\n\n

How exactly will it impact my users? <\/strong><\/h2>\n\n\n\n

Every browser and operating system relies on a certificate trust store<\/a> to verify the authenticity of SSL\/TLS certificates presented by websites. This trust store contains a list of trusted certificate authorities (CAs), including Let\u2019s Encrypt, that browsers and other devices use to validate a website’s security. <\/p>\n\n\n\n

When a CA like Let\u2019s Encrypt updates its trust model, devices with outdated or unsupported operating systems may lose their ability to recognize and trust certificates issued by that CA, leading to potential security warnings or blocked access<\/a>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

For example, Android devices running versions below 7.1.1 are particularly at risk (the current version of Android is 14, and Android 7 reached end-of-security-support<\/a> in October 2019). <\/p>\n\n\n\n

Let\u2019s Encrypt estimates<\/a> that around 6% of Android devices will be affected by this change, which could result in users encountering security warnings, being unable to establish a secure connection, or even being blocked from accessing your site. <\/p>\n\n\n\n

The impact on your users will largely depend on the composition of your audience. That said, it’s important to monitor your website access logs<\/a> to identify the devices your site visitors are using. Specifically, you should look for Android user-agents running version 7 or earlier, such as: ‘Linux; Android 7.0.'”<\/p>\n\n\n\n

How can I prepare for potential impacts? <\/strong><\/h2>\n\n\n\n

Being proactive in addressing these issues can help ensure all site users, regardless of their devices, continue to have a secure and seamless experience on your site. <\/p>\n\n\n\n

Additionally, you may want to communicate with your users, particularly if you know a portion of your audience uses older devices, to inform them of the upcoming changes and even suggest they update their operating systems or browsers to avoid potential access issues.<\/p>\n\n\n\n

For customers concerned about a wider impact, working with a third-party CA, such as SSL.com<\/a> may be of interest. WP Engine offers the option to import a third-party SSL certificate, however, there are some additional requirements and stipulations<\/a> to consider. <\/p>\n\n\n\n

More importantly, many third-party CAs may have also curtailed support for older devices, so customers should verify the following if they choose to pursue this route:<\/p>\n\n\n\n