ISRG Root X1 Certificate on Android versions below 8

[Gedsh]

Unfortunately, this code doesn't work for Android versions below 8, as Go still checks the chain of trust, while ISRG Root X1 is self-signed.

The only solution is to add tlsClientConfig.InsecureSkipVerify = true, which completely disables certificate chain verification. But this is not acceptable for security reasons.

Also, recently expired ISRG Root X1 certificate, which was cross-signed by IdenTrust's DST Root CA X3. It was a workaround until the first of October. https://letsencrypt.org/2023/07/10/cross-sign-expiration.html

Is there any solution to add an ISRG Root X1 certificate to DNSCrypt and not disable certificate chain verification completely?

[jedisct1]

Do actual servers still use that certificate?

[Gedsh]

Yes. And quite often. A lot of DOH servers chose Let's Encrypt because it's free.

[Gedsh]

If we take InviZIble's default DOH servers ‘ahadns-doh-la’, ‘dnsforge.de’, ‘libredns-noads’, ‘mullvad-base-doh’ - none of them work on android below 8.