Certificate Trusted Everywhere Except Old Devices? Blame the Root

Your site works in every current browser, but an old Android phone, a smart TV, a payment terminal or an aging Java service says the certificate isn't trusted. The certificate is usually fine. The device just doesn't know the root certificate it chains to.

Why old devices fall behind

Every device trusts a list of root certificates, its trust store, and that list only changes with updates. When a device stops getting updates, its list freezes. CAs keep moving to newer roots, because old roots expire or are removed from root programs, and a frozen device never learns the new ones.

Browsers can differ from the device they run on. Chrome uses its own Chrome Root Store since Chrome 105 (2022), and Firefox ships its own list on every platform. So a site can fail in one app and work in another on the same phone.

Two changes that caught people out

• Let's Encrypt and older Android. Let's Encrypt chains to its own root, ISRG Root X1. For years it also served a chain cross-signed by an older root that old Android devices trusted. The short chain became the default on February 8, 2024, and the cross-signed certificate expired on September 30, 2024. Devices on Android 7.0 or earlier that don't trust ISRG Root X1 now fail (Let's Encrypt's announcement).
• DigiCert G1 to G2. DigiCert's G1 roots were removed from Chrome and Mozilla on April 15, 2026, so DigiCert certificates now chain to its G2 roots. Devices whose trust store predates G2 don't trust the new chain.

What you can do

You can't update your customers' devices, so the choices are on your side:

1. Find out who is affected. Check your logs for the user agents or clients that fail. Often it's a small group you can name, like one partner's integration or one model of terminal.
2. Ask your CA about older chains. Some CAs offer a chain to an older, widely trusted root for compatibility. Check what it is and when it expires.
3. Serve legacy clients separately. If one integration can't change, give it its own hostname with a certificate from a CA it trusts, and keep your main site on the modern chain.
4. For your own apps, ship the root they need with the app, but read about certificate pinning first: hardcoded certificates cause their own outages.
5. For people, the fix is updating the device or using a browser with its own trust store, such as Firefox on Android.

Check before you switch CAs or chains

Scan your domain free to see whether your chain is trusted by the Mozilla, Apple, Android, Java and Windows trust stores. A failure in one of them tells you which devices to test.