lehttp_overrides

Package Overview

Package selection guidance compiled from public package information, community data, and project usage.

A Flutter package designed to address SSL certificate issues caused by Let's Encrypt on Android 7.1.1 and earlier versions. It provides necessary HTTP overrides to ensure secure connections remain functional on older Android devices. The package is particularly useful for apps targeting legacy Android systems where certificate validation fails due to outdated trust stores. It integrates seamlessly with existing HTTP clients and requires minimal configuration. Maintained by netfarm.it, it supports multiple platforms including Android, iOS, macOS, Windows, and Linux.

Use cases

Fixing SSL errors on Android 7.1.1 and below
Enabling secure API calls on legacy Android devices
Ensuring compatibility with Let's Encrypt certificates
Supporting older devices in enterprise or public-facing apps
Maintaining HTTPS connectivity across platform versions

Key features

Built-in SSL certificate fixes for Android 7.1.1
Minimal setup required
Cross-platform support
Compatible with standard HTTP clients
Open-source and actively maintained

Suitable for

Developers targeting older Android devices
Apps requiring reliable HTTPS on legacy systems
Projects using Let's Encrypt certificates
Teams maintaining backward compatibility
Enterprise applications with diverse device fleets

Considerations

Not needed for Android 8.0 and above
May require additional testing on older devices
Limited to SSL-related issues on Android
Does not affect iOS or other platforms directly
Best used when combined with proper certificate pinning if required

Original README

Original README snapshot from the linked source repository. Visit the repository for the latest content.

A Flutter package to resolve Let's Encrypt SSL certificate problems with Android 7.1.1 and below

More information here (Italian)

Getting Started

To enable the fix you need to add this line at the beginning of your project:

import 'package:lehttp_overrides/lehttp_overrides.dart';

void main() {
  if (Platform.isAndroid) {
    HttpOverrides.global = LEHttpOverrides();
  }
  runApp(const MyApp());
}

This works if you are using ISRG Root X1 certificate path by adding ISRG Root X1 CA to certificate store.

This is harmless on Android > 7.1.1 because the system already has it.

An optional parameter of the constructor allowExpiredDSTX3 (defaults: false) allows to accept as valid the DST Root CA X3 expired certificate. OpenSSL >= 1.1 should not trigger this check, but old Android versions still need it.

My suggestion is to leave this disabled and use ISRG Root X1 certiicate path.

Search packages, repositories and app categories