Posted by David George 1 on 28/06/2022 07:17:57:
The security problem with my tablet was working with no problem last night but this morning it's reared its ugly head, unsafe web site again. Samsung Galaxy Tab S2, Android V 7. No problem with any other site.
David
Have you tried installing Firefox Mobile on the Galaxy and using that to browse the forum? In theory, because Firefox handles the certificates rather than relying on Android, and has been kept up to date it should work.
The symptoms fit a known combination of circumstances, whereby the client device fails if:
- A website starts using a new certificate AND
- The new certificate was issued by a new Certificate Authority, AND
- The client device hasn't been upgraded to recognise Certificate Authorities created after the device was first sold, AND
- The client device hasn't been upgraded to correctly check the validity of a new certificate by asking one of the Certificate Authorities it does trust. The way this check is done changed after Android 7 was released.
From the description, I think David's Galaxy gets the forum's new certificate and doesn't trust it because it doesn't recognise the new Authority. It then asks one of the Certificate Authorities it knows of to confirm the new boy is OK. The certificate is confirmed, and the Galaxy connects. So far so good.
Unfortunately, certificates are re-checked repeatedly during sessions, and one of these checks fails later on and Android drops the connection like a red-hot potato because it no longer trusts the website. I suspect, having been told the new certificate authority is OK, Android 7 isn't caching a copy of new certificate, and does the later check with a copy of the old one, which is now wrong. Might be fixed by a factory reset.
The reason the Galaxy appears to be working correctly with other websites is most of them don't meet the four AND conditions needed to trigger the fault – yet! The error isn't with the certificate itself, or a real security problem, its because the way certificates are managed has changed slightly, and Android 7 doesn't understand the new regime.
The website that explains this stuff recommends Firefox as a fix because it doesn't rely on Android 7 to get the security checks right. And because Firefox is kept to up to date, it should manage new certificates from a new authority without dropping the ball. I don't know for sure Firefox fixes the problem but surely worth trying.
In general always good to keep computers up to date. The rate of change is rapid and it doesn't take long for mismatches between old and new to appear, causing weird bugs.
Dave
.