: Making a Let's Encrypt-secured site viewable on Windows Mobile 6.5 I operate a web application that I intend to make available through HTTPS to users of barcode-scanning PDAs running Windows Embedded

Posted in: #Https #Mobile #SecurityCertificate #Windows

I operate a web application that I intend to make available through HTTPS to users of barcode-scanning PDAs running Windows Embedded Handheld 6.5 Professional, which was Microsoft's branding for Windows Mobile 6.5 on non-cellular devices. But users of that operating system get an error that the Let's Encrypt certificate authority is not trusted. How should I inform my Windows Mobile 6.x users about how to install the Let's Encrypt root certificate?

The site had previously used GoDaddy as a CA. When I renewed the site's SSL certificate through Let's Encrypt, my clients reported receiving the following error message:

Information you exchange with this site cannot be viewed or changed by others. However, there's a problem with the site's security certificate.

[Exclamation point in yellow triangle] The certificate was issued by a company you have not chosen to trust.
[Checkmark in green circle] The certificate date is valid.
[Checkmark in green circle] The certificate has a valid name matching the name of the page you are trying to view.

I obtained a device for testing and saw the same error on the Let's Encrypt site itself. I tried these:

I downloaded the "Let's Encrypt Authority X3" certificate in .txt format, renamed it to .cer, and opened it on the device. It showed a message that the certificate was installed.
Following the "Cross Signing" instructions on the same page, I downloaded the "DST Root" certificate, pasted it into a .txt file, added -----BEGIN CERTIFICATE----- on its own line at the top and -----END CERTIFICATE----- on its own line at the bottom, renamed it to .cer, and opened it on the device. I got two prompts about the dangers of installing a certificate, and I clicked the not-Block button twice (I think the messages were "More" and "Install") and got a message that the certificate was installed.

But these still wouldn't let me view my site or letsencrypt.org. I know WM6.5 is SNI-ignorant, but that's not the problem because "The certificate has a valid name". What can my clients do to get LE's root certificate installed?