Skip to main content

It seems that #Fedilab started to fail for some instances. That happens on older devices (Android 5 and 6).
We will reintroduce conscrypt to patch the security provider for older devices.
https://github.com/google/conscrypt

GitHub - google/conscrypt: Conscrypt is a Java Security Provider that implements parts of the Java Cryptography Extension and Java Secure Socket Extension.

Conscrypt is a Java Security Provider that implements parts of the Java Cryptography Extension and Java Secure Socket Extension. - google/conscrypt
GitHub
#fedilab
in reply to Fedilab Apps

sᴉnꓶɐʇoſ
sᴉnꓶɐʇoſ
• •
Hi, @apps .
May be reading this may help: https://mastodon.social/@pachli/112202031395526260 .

Pachli (@pachli@mastodon.social)

Hey @milan@social.tchncs.de, I'm seeing a weird issue with your server that means all the Android clients I've tried (Pachli, obviously, but also the official Mastodon app, Megalodon, Trunks, and Tusky), can't login.
Mastodon
@Fedilab Apps
in reply to sᴉnꓶɐʇoſ

Fedilab Apps
Fedilab Apps
• •
@Piky_Nieves
Interesting to know thank you. Currently, the issue reported occurs during the first step before getting the authorization step.
@sᴉnꓶɐʇoſ
in reply to Fedilab Apps

sᴉnꓶɐʇoſ
sᴉnꓶɐʇoſ
• •
You're welcome. I think that is a common issue due to what's been explained there.
in reply to Fedilab Apps

Daniel Gultsch
Daniel Gultsch
• •

This sounds like a Problem with Letsencrypt. Letsencrypt has stopped cross signing their certifates with a root that older Android versions have.
Introducing conscrypt won't fix the issue.
You'll have to bundle the Letsencrypt root.

Here is how #Conversations_im did it: https://codeberg.org/iNPUTmice/Conversations/commit/88851ea12a9ea9d546a04321742a9656733291c3

The commit has also a link to a blog post explaining the issue.


bundle letsencrypt root certificates · 88851ea12a

as per https://letsencrypt.org/2023/07/10/cross-sign-expiration.html Letsencrypt is dropping support for Android <= 7 by removing cross signing. to keep supporting older Android versions we need to bundle the root cert ourselves.
Codeberg.org
#conversations_im
in reply to Fedilab Apps

Nordnick :verified:
Nordnick :verified:
• •

@daniel

Thanks for the info.

So there is no possibility to fix this for the whole device? Several apps affected here on an Android 7 device.

See
https://mammuthus.de/@nick/69

@Daniel Gultsch
in reply to Fedilab Apps

Nordnick :verified:
Nordnick :verified:
• •

Could this be also related to this effect?

https://mammuthus.de/@nick/69

(on Android 7)

in reply to Nordnick :verified:

Fedilab Apps
Fedilab Apps
• •

@nick
We got a tip to solve that issue: https://gultsch.social/@daniel/112205723911295152

Daniel Gultsch

2024-04-03 05:51:12


This sounds like a Problem with Letsencrypt. Letsencrypt has stopped cross signing their certifates with a root that older Android versions have.
Introducing conscrypt won't fix the issue.
You'll have to bundle the Letsencrypt root.

Here is how #Conversations_im did it: https://codeberg.org/iNPUTmice/Conversations/commit/88851ea12a9ea9d546a04321742a9656733291c3

The commit has also a link to a blog post explaining the issue.



bundle letsencrypt root certificates · 88851ea12a

as per https://letsencrypt.org/2023/07/10/cross-sign-expiration.html Letsencrypt is dropping support for Android <= 7 by removing cross signing. to keep supporting older Android versions we need to bundle the root cert ourselves.
Codeberg.org

@Nordnick :verified:
in reply to Fedilab Apps

far9
far9
• •

#Fedilab

I apologise. I'd like to ask: is this normal behaviour for a program with proxy enabled, where only text is downloaded and all media is downloaded directly?

If I block Fedilab with a firewall so that it works exclusively through a proxy, then access to media content is completely blocked. Is this the way it was designed or is it a bug?

#fedilab
⇧