[fergusd]

A perfectly respectable UK news outlet inews.co.uk is today showing Site Blocked. And not along the trajectory that permits an exception.
How has this development suddenly occurred and is there a workaround?

Posted via CB10

[conite]

A perfectly respectable UK news outlet inews.co.uk is today showing Site Blocked. And not along the trajectory that permits an exception.
How has this development suddenly occurred and is there a workaround?

Posted via CB10

Seem fine here. Did you try your Android browser? I assume you have Kiwi or Fennec as a backup?

[bhastings18]

same thing here in usa with my local & national newspapers and local news channel; also some other online sites and apps. it looks like it has to do with licensing. i'm assuming right now that it's the beginning of the "no-support" end by verizon for my bb classic beginning 1-4-22, but don't know for sure. would like to know.

[bhastings18]

it started for me on 9-30 & 10-1.

[The_Disembodied]

I can confirm the stock browser has started showing this error since a couple days for random sites on my Z30.
My example is canac.ca. Doesn't work on stock browser and browsie browser but still works with mozilla and kiwi.

Posted via CB10

[rthonpm]

This is likely related to the expiration of Let's Encrypt's root certificate. Both inews.co.uk and canac.ca use Let's Encrypt for their TLS certs.

If you want to continue to use the stock browser, you'll need to download their new cert string and root CA.

[anon(10512033)]

@fergusd @bhastings18 @The_Disembodied

You can find a solution here: https://forums.crackberry.com/blackb.../#post13600770

[Paul Sinatra]

Also Quora, Wikipedia and Duckduckgo, starting about the dates mentioned. Thanks for the link, hopefully one DL will solve them all.

Posted via CB10

Update Oct 5 - worked a charm, thanks. And surprisingly simple.

[anon(10512033)]

Also Quora, Wikipedia and Duckduckgo

Tested and working.

[fergusd]

Thank you. I found ISRG Root X1 as described but no sign of Let's Encrypt Authority X3. I just processed the first. All of iNews, DuckDuckGo and Wikipedia working. Thank you!

[anon(10512033)]

Thank you. I found ISRG Root X1 as described but no sign of Let's Encrypt Authority X3. I just processed the first. All of iNews, DuckDuckGo and Wikipedia working. Thank you!

Hmm. That's interesting. Clearly you don't need the Let's Encrypt Authority X3 certificate then. I usually just stop fiddling when something starts to work.

I'll edit the first post in the other thread.

[brookie229]

Thank you. I found ISRG Root X1 as described but no sign of Let's Encrypt Authority X3. I just processed the first. All of iNews, DuckDuckGo and Wikipedia working. Thank you!

I found Let's Encrypt but it was not where Shuswap mentioned as above. Check very carefully under categories of each section. It was tricky to find.

[anon(10512033)]

I found Let's Encrypt but it was not where Shuswap mentioned as above. Check very carefully under categories of each section. It was tricky to find.

It seems that you don't actually need that certificate, so I've removed it from the steps. I'll delete it from my Passport when I get it off the charger and test it myself to confirm @fergusd's experience.

Edit: confirmed.

Btw, I suspect the different certificate categories in Firefox must be due to the fact that mine's the Extended Support Release or that it's the Linux version. There are some strange differences between versions...

[i_plod_an_dr_void]

In [Settings][Security and Privacy][Certificates]
I located the Cert that the browser complained about. In this case trying to access Wikipedia (and a bunch of other sites) complained about [ ISRG Root X1].
( Details in Browser:

shows Site Blocked with Red X stop sign. Click [Expand for Details] Click [View Certificate])

So I disabled it by unselecting the Trust checkbox.
Tried to reload Wikipedia in the browser, it still complained. But now it showed another Cert in the chain , specifically [DST Root CA X3].
( Details in Browser:

Shows Site Blocked with Red X stop sign. But now under [Expand for Details] it also shows "The root CA certificate expired on Thu Sep 30,2021 ..." Click [View Certificate]. Now you will see [DST Root CA X3] in the certificate info. This is the problem certificate.)

When you examine the details of this certificate in the browser, you see that it expired Sept 21, 2021.
Seems the Certificate chain was snagged by this expiry, but the browser didn't exactly show the specific certificate that was causing the trouble.

(1) So go back into [Certificates] from [Settings] following the steps above,
(2) Find [DST Root CA X3] (which is expired) and unselect the [Trusted] Checkbox.
(3) Find [ISRG Root X1] and re-select the [Trusted] Checkbox .

I don't know if this is the best solution. But it worked. Perhaps re-downloading the Certificate chain fixes the problem, I didn't try that. Does anyone know?
I know Let's Encrypt apparently did something unusual with that [DST Root CA X3] to allow old Android devices to continue to work - because they ignore expiry dates and they don't have newer certificates that BB10 does. Also it is possible they can't download new certificates that BB10 can?

[edmbugger]

In [Settings][Security and Privacy][Certificates]
I located the Cert that the browser complained about. In this case trying to access Wikipedia (and a bunch of other sites) complained about [ ISRG Root X1].
( Details in Browser:

shows Site Blocked with Red X stop sign. Click [Expand for Details] Click [View Certificate])

So I disabled it by unselecting the Trust checkbox.
Tried to reload Wikipedia in the browser, it still complained. But now it showed another Cert in the chain , specifically [DST Root CA X3].
( Details in Browser:

Shows Site Blocked with Red X stop sign. But now under [Expand for Details] it also shows "The root CA certificate expired on Thu Sep 30,2021 ..." Click [View Certificate]. Now you will see [DST Root CA X3] in the certificate info. This is the problem certificate.)

When you examine the details of this certificate in the browser, you see that it expired Sept 21, 2021.
Seems the Certificate chain was snagged by this expiry, but the browser didn't exactly show the specific certificate that was causing the trouble.

(1) So go back into [Certificates] from [Settings] following the steps above,
(2) Find [DST Root CA X3] (which is expired) and unselect the [Trusted] Checkbox.
(3) Find [ISRG Root X1] and re-select the [Trusted] Checkbox .

I don't know if this is the best solution. But it worked. Perhaps re-downloading the Certificate chain fixes the problem, I didn't try that. Does anyone know?
I know Let's Encrypt apparently did something unusual with that [DST Root CA X3] to allow old Android devices to continue to work - because they ignore expiry dates and they don't have newer certificates that BB10 does. Also it is possible they can't download new certificates that BB10 can?

Zero problems now. Thanks a million dude

[ubeda92]

Thanks very much. "Untrusting" the "DST Root CA X3" certificate helped with several websites that the native browser hadn't been accessing.