Electric Prayer

The Liturgy of the Hours, the Mass, and other things.

Universalis and old iPads

Posted by universalis on 13 November 2021

A recent change in the Internet means that older iPads such as the iPad 2 or the original iPad Mini are unable to reach many web sites (even Wikipedia is affected, apparently!).

This problem prevents Universalis and Catholic Calendar from connecting to our servers. The result is that music and audio cannot be downloaded, and that it is not possible to unlock Catholic Calendar using a registration code.

This blog post explains how to get round this problem, both for Universalis and for all other affected web sites.

The technical background

The iPad 2 and the original iPad Mini use iOS 9, which was last updated five years ago.

iOS 9 requires apps to use an encrypted connection to Internet servers. The encryption depends on what is called a “root certificate” which certifies that the web site being visited is a genuine one. A list of trusted root certificates is built into iOS, but one of the main suppliers of certificates, Let’s Encrypt, uses a new root certificate which is not built into iOS 9, and since the end of September 2021 this has been causing problems.

The symptoms

  • If you visit any web site protected by the new root certificate (including Universalis and, we are told, Wikipedia), Safari pops up a message saying “The identity of [this site] cannot be verified by Safari. Review the certificate details to continue.” But it does let you tell it to trust the site, if you want to.
  • When you try to play speech or music in Universalis or Catholic Calendar, and you haven’t downloaded it before, the download fails. The cause of the failure is reported as “An SSL error has occurred and a secure connection to the server cannot be made”.
  • If you have Catholic Calendar and you have bought a registration code from us and you try to enter the registration code (to make Catholic Calendar behave just like Universalis), you get the same failure.

How to cure the problem

You need to download the new root certificate manually from Let’s Encrypt, and tell your iPad to trust it.

  1. To download, click on this link: https://letsencrypt.org/certs/isrgrootx1.pem
  2. You will get a message saying “The identity of [this site] cannot be verified by Safari. Review the certificate details to continue.” Tap on “Details” and then, when you see the details (they will refer to a site called “lencr.org”), tap the button marked “Trust” in the top right-hand corner.
  3. The certificate will now be downloaded.
  4. Your iPad will automatically switch to the Settings app and display a message referring to “ISRG Root X1”, marking it as “Not verified”.
  5. Tap the button marked “Install” in the top right-hand corner and then, in the next screen, confirm your request by tapping “Install” again.
  6. A message will pop up saying just “Install Profile”, and it too will have a button marked “Install”. Press that button.

Further reference

A discussion on the Apple Community Forums describes the problem and the solution. Note that the answer marked as “Solved” is not the right answer. The answer you want is from “parapunter” on Oct 6, 2021.

Let’s Encrypt’s certificate compatibility page gives more details of exactly what devices can understand the Let’s Encrypt root certificate.

Sorry, the comment form is closed at this time.