Login issues via external SSO on older Android versions after certificate update (OCSP support removed)

Evaldas 0 Reputation points
2026-05-11T12:31:15.5833333+00:00

Hello,

We use Office 365 with our SSO. After the SSO web certificate was updated, we started receiving multiple tickets from users with Android 13 and older, reporting white screens or SSL errors when trying to log in. On the SSO server side, we see an 'SSL handshake failure' error. The new certificate no longer supports OCSP, so we assume these issues could be related.

Do older MS Office apps rely on OCSP?

For example, for testing, I used Android 9 and Microsoft Word 16.0.16501.20160.

I have also attached a screenshot of the error I received.Screenshot_20260511-142006_Word

Microsoft 365 and Office | Word | For business | Android
0 comments
Answer recommended by moderator
Evaldas 0 Reputation points
2026-05-13T05:38:03.29+00:00

Hello,

Thank you for the fast response.

I figured out what was wrong. The issue was not related to Microsoft apps. The older Android devices (version 13 and older) are missing our root CA certificate.

Was this answer helpful?

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2026-05-11T14:27:25.49+00:00

    Hi @Evaldas
    Based on my research, the Office 365 apps do not directly rely on OCSP. Instead, they depend on the Android platform’s TLS/SSL stack and the WebView authentication flow. During this process, certificate validation is handled by the platform, which may include revocation checks through OCSP or CRL as part of the connection. 

    In addition, I came across a related discussion here: rest - Update to Android 16 (SDK 36) causes CertPathValidatorException with API calls - Stack Overf… 

    While it references a newer Android version, the behavior described shows a similar pattern where the interaction between OCSP and the SSL handshake can lead to validation failures. 

    As suggested in that discussion, you may consider running the following command to review the OCSP response details, particularly the “Next Update” timestamp: 

    openssl s_client -connect yourdomain.com:443 –status 

    This information is provided as a convenience to you. These sites are not controlled by Microsoft, and Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please ensure that you fully understand the risks before using any suggestions from the above link. 

    At the moment, if OCSP stapling (TLS Certificate Status Request) is not enabled or supported on your SSO endpoint, you may consider moving toward a more modern approach. For example, using short‑lived certificates or falling back to CRL could be suitable alternatives, depending on how your environment is currently designed. 

    Additionally, as this forum mainly focuses on break-fix scenarios for Office 365 applications, for more advanced technical discussions I would recommend reaching out to the broader technical community through https://techcommunity.microsoft.com/ and https://github.com/orgs/community/discussions. These platforms often include engineers and partners who have worked through similar scenarios and can share practical insights based on their experience. 

    I hope this provides some additional insight. 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

     

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.