B2C Commerce is adopting the Let’s ISRG Root X1 chain certificates to enhance security and compatibility with current devices.
Why: Effective September 30, 2024 Let’s Encrypt certificate chain cross-signed with IdenTrust is set to expire. The update to the ISRG Root X1 chain is crucial for maintaining secure connections, especially as the older cross-signed chain expires.
How: In anticipation of this event, B2C Commerce eCDN Managed certs is ceasing the issuance of certificates from the cross-signed chain. For all upcoming Let’s Encrypt certificates, B2C Commerce now uses the Let’s ISRG Root X1 chain. This change specifically affects customers using Let’s Encrypt certificates and receiving requests from older client systems.
The transition to the new certificate chain impacts older devices and systems, particularly those running Android versions 7.1.1 or below. These devices and systems rely solely on the cross-signed chain and don’t include the ISRG X1 root in their trust store. Users of these devices can experience TLS errors or warnings when accessing domains secured by Let’s Encrypt certificates.
Starting September 9, 2024, certificates issued by Let’s Encrypt aren’t compatible with legacy devices operating on Android versions 7.0 or earlier. This change specifically affects customers using Let’s Encrypt certificates and receiving requests from older client systems.
Recent data from Let’s Encrypt indicates that over 93.9% of Android devices currently trust the ISRG Root X1. This figure is expected to grow in 2024, especially with the release of Android version 14 which streamlines the upgrade process of the Android trust store.