Passify

3rd-Party Certificate Errors

When you enable Passify features that utilize a 3rd-party, Passify attempts to connect to these services using a secure connection.

On older devices, or devices that have not been kept up-to-date, some features that make requests to 3rd-parties may fail due to being unable to connect securely. This includes sync, icon fetching and HaveIBeenPwned password compromise checking. These failures may be due to issues with the security certificates that come pre-installed on your device, usually by the manufacturer.

In particular, this can happen when any 3rd-party service uses Let's Encrypt as their certificate provider (such as HaveIBeenPwned.com). In 2021, Let's Encrypt began the process of changing how they managed their certificates. Unfortunately, some devices still contain expired copies of certificates used for verifying Let's Encrypt.

These expired certificates on your device can cause secure connections to fail. To resolve the issue, you must disable the old, expired certificate on your device. Disabling these old certificates will allow your device to use the newer and valid certificates instead.

Disabling Expired Certificate Authority

If you are alerted that HaveIBeenPwned compromise checking is failing, see failures to securely connect to sync providers, or notice a number of icons that do not load, you may need to disable expired certificates pre-installed by your device's manufacturer.

If these steps do not resolve the issue, you may need to install Let's Encrypt's latest root certificates on your device. If the issue persists, you may have to disable the Passify feature or choose an alternate sync provider.

Android 7 or earlier:

  1. Launch Settings
  2. Tap "Security"
  3. Locate and tap "Trusted Credentials"
  4. In the list, locate the entry titled "Digital Signature Trust Co. / DST Root CA X3." This is the expired credential used for Let's Encrypt certificates.
  5. Tap the "Digital Signature Trust Co." item. You should see that it is already expired.
  6. Tap the "Disable" button and confirm. Passify's HaveIBeenPwned checks should now complete successfully.

Android 8-12:

  1. Launch Settings
  2. Tap "Security" or "Security & Location"
  3. Tap "Encryption & Credentials"
  4. Tap "Trusted Credentials"
  5. Under the "System" list, locate the entry titled "Digital Signature Trust Co. / DST Root CA X3." This is the expired credential used for Let's Encrypt certificates.
  6. Toggle the switch to disable the expired credential. Passify's HaveIBeenPwned checks should now complete successfully.

Android 13 or later:

  1. Launch Settings
  2. Tap "Security"
  3. Tap "More Security Settings"
  4. Tap "Encryption & Credentials"
  5. Tap "Trusted Credentials"
  6. Under the "System" list, locate the entry titled "Digital Signature Trust Co. / DST Root CA X3." This is the expired credential used for Let's Encrypt certificates.
  7. Toggle the switch to disable the expired credential. Passify's HaveIBeenPwned checks should now complete successfully.

Article Categories