SHA1-Deprecation for SSL & Code Signing Certificate

Mozilla was forced to backpedal on banning new SHA-1 digital certificates because the move completely cut off some Firefox users from the encrypted Web. It appears that Google saw the problem coming. Instead of banning all digital certificates signed with SHA-1 and issued after Jan 1, Google plans to only “untrust” those that originate from public certificate authorities.

This decision takes into account that some companies might still use self-generated SHA-1 certificates internally on their networks, or that some antivirus programs and security devices will continue to generate such certificates when inspecting HTTPS traffic.

As a result, the CA/Browser Forum, a group of certificate authorities and browser makers that sets guidelines for the issuance and use of digital certificates, decided that new SHA-1-signed certificates should not be issued after Jan. 1, 2016.

Microsoft’s SHA-1 deprecation plan differs in the activation time and browser behaviour. Microsoft’s security advisory on “Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program” informed us that Windows will cease accepting SHA-1 SSL certificates on January 1, 2017. To continue to work with Microsoft platforms, all SHA-1 SSL certificates issued before or after this announcement must be replaced with a SHA-2 equivalent by January 1, 2017.

The SHA-1 deprecation plans also impact SHA-1 intermediate certificates; SHA-2 end-entity certificates must be chained to SHA-2 intermediate certificates to avoid the adverse browser behaviour’s described above. SHA-1 root certificates are not impacted.

As technology evolves, it is critical to stay ahead of those who wish to defeat cryptographic technologies for their malicious benefit. Symantec is helping to make the Internet more secure by proactively enabling, promoting, and elevating strong cryptographic standards within SSL/TLS and code-signing certificates. As part of this effort, Symantec has made available SHA-2 replacement certificates at no additional charge to our customers.

The initiative to migrate from SHA-1 to SHA-256 (SHA-2) is the next proactive phase to better secure websites, intranet communications, and applications. Organizations need to develop a migration plan for any SHA-1 SSL and code signing certificates

Mozilla decided to lift the SHA-1 ban, at least temporarily, in Firefox 43.0.4.

The latest version of Firefox re-enables support for SHA-1 certificates to ensure that we can get updates to users behind man-in-the-middle devices, and enable us to better evaluate how many users might be affected,” the company said in a blog post. “Vendors of TLS man-in-the-middle systems should be working to update their products to use newer digest algorithms.”

SHA-1 certificates issued before Jan. 1, 2016 will continue to be trusted until at least July 1, 2016, depending on the browser, but no later than Jan. 1, 2017.

If you are still using I SHA-1 certificate, please consider upgrading to SHA-2 in the first half of 2016.

For more information drop an email : support@adwebtech.com or call : (+9122) 42978084