Let's Encrypt E1 != LG, Samsung .etc (Smart TV)

[user4728]

Hello.

I’ve been suffering for the second day and I can’t find the answer on Google/Cloudflare forum.

The problem is that new domains in Cloudflare are issued a Let’s Encrypt certificate, which is not supported by TVs until 2017. My users complain that they can’t watch my website from TVs.

I was looking for a solution how to enable the Google Trust Services certificate
(which is in the backup). This certificate works on older TVs.

Please make it possible to choose a certificate.
Or give the opportunity to use the certificate on the domain server, and not the certificate from Cloudflare (without disabling proxying).

[neiljay]

Hello there,

I assume, here you’ve enabled TLS v 1.3 (the latest version) on your domain. If you are managing the domain in Cloudflare, you can change the minimum TLS version and try.

[user4728]

Is that what you mean? The first or the second option?
I have the standard settings.

On old sites that were added before May 2022, there is a certificate from Google (excellent) with the same settings, that is, with the standard ones from Cloudflare.

[neiljay]

@user4728

The first or the second option?

Minimum TLS version this option which is at the moment is set to TLS 1.0 (default) (First option)

[user4728]

This is all bad advice.
The only way out, unfortunately, is to pay $ 10 per month for an extended certificate, the only way you can get TV support:(

[neiljay]

My bad. I got you now!

[Lumito]

@user4728

The only way out, unfortunately, is to pay $ 10 per month for an extended certificate, the only way you can get TV support:(

That’s the best option to be able to choose between CAs, but you can switch to GTS without ACM via the API.

I have just made another post explaining this:

I want to use Google Trust's SSL certificate instead of Let's Encrypt

The best option is to use Advanced Certificate Manager, since you are able to customize the CA, the certificate duration, SANs, etc. However, there’s a quick trick to make the change to Google Trust Services, and it’s via the API. You’ll need your Global API key, your domain’s zone ID and your email address. Open a command prompt (cmd) on Windows, or Terminal on Mac or Linux. Type (for Mac/Linux): curl -sX PATCH "https://api.cloudflare.com/client/v4/zones/[DOMAIN_ZONE_ID_HERE]/ssl/universal…

Hope it helps!

[user4728]

{“success”:false,“errors”:[{“code”:1003,“message”:“Invalid or missing zone id”}],“messages”:,“result”:null}

[DOMAIN_ZONE_ID_HERE] to take from here?

[Lumito]

No, that’s your account ID. It’s taken from your domain Overview page (bottom-right corner).

[user4728]

Thanks. Very useful advice. Turn out.