Tuesday, April 29, 2025
HomeCryptocurrency hackFinal countdown for SHA-1 SSL certificates

Final countdown for SHA-1 SSL certificates

Published on

SIEM as a Service

Follow Us on Google News

SHA-1 SSL certificates which are more popular and an sucessor of MD5 algorithm are now in the final days of what was once one of the most widespread types of SSL certificates:SHA-1.

Now, due to the ever present requirement to strengthen processes and techniques against a background of constantly improving computational power, it is the turn of SHA-1 to be replaced with its successor – SHA-2.

For those cheering the demise of this much-maligned algorithm, the news is good as the end is quite near:

- Advertisement - Google News

Mozilla Firefox: From Firefox version 51, the browser will show an “untrusted connection” error warning for any site still using SHA-1.

Microsoft Internet Explorer and Edge: Starting on February 14, websites still using SHA-1 will get a rather unpleasant Valentines Day gift: the browsers will not load their websites whatsoever, though users can still opt to continue to the website after seeing a warning message.

Google Chrome: At the end of January next year, with the release of version 56, Chrome will stop trusting any SHA-1 SSL certificate and will provide a security warning.

Apple Safari: We do not have exact dates on when Apple will officially stop trusting SHA-1 certificates. The latest release notes for MacOS urge sites to drop SHA-1 as soon as possible, and websites loaded in the Sierra version already do not show the green padlock that indicates a trusted site.

What older clients don’t support SHA256

Many older clients don’t support SHA256, but the real question is which of those are relevant? The answer will vary depending on the site. For detailed information on client capabilities, head to Comodo, which maintains a detailed summary of SHA256 support for a large number of platforms.

Code-signing certificates

To be trusted by Microsoft applications/platforms, then all SHA1 code signing certificates should be replaced before 1 January 2016.

Digital signatures created from SHA-1 code signing certificates that weretimestamped before 1 January 2016 will continue to be trusted on Windows platforms but digital signatures without a timestamp will not be trusted.  It is always good practice to timestamp digital signatures when signing code.

Personal (S/MIME) certificates

We are not aware of information relating to when SHA1 personal certificates will become obsolete; but they will be in due course. It is recommended to replace these as soon as possible or before 1 January 2016 (as with code-signing certificates).

Further information

http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx
https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/         http://www.comodo.com/e-commerce/SHA-2-transition.php
http://googleonlinesecurity.blogspot.in/2014/09/gradually-sunsetting-sha-1.html

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

19 APT Hackers Target Asia-based Company Servers Using Exploited Vulnerabilities and Spear Phishing Email

The NSFOCUS Fuying Laboratory’s global threat hunting system identified 19 sophisticated Advanced Persistent Threat...

FBI Reports ₹1.38 Lakh Crore Loss in 2024, a 33% Surge from 2023

The FBI’s Internet Crime Complaint Center (IC3) has reported a record-breaking loss of $16.6...

Fog Ransomware Reveals Active Directory Exploitation Tools and Scripts

Cybersecurity researchers from The DFIR Report’s Threat Intel Group uncovered an open directory hosted...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Crypto Platform OKX Suspends Tool Abused by North Korean Hackers

Cryptocurrency platform OKX has announced the temporary suspension of its Decentralized Exchange (DEX) aggregator...

Authorities Seize $31 Million Linked to Crypto Exchange Hack

U.S. authorities announced the seizure of $31 million tied to the 2021 Uranium Finance...

Stablecoin Bank Hit by Cyberattack, Loses $49.5M to Hackers

The cryptocurrency sector faced one of its most significant security breaches this year as...