website statistics
SHA-2 / SHA-1 SSL Test Tool
Check your Website for SHA-1 Migration
Cheap SSL Coupon Code


SHA Announcement

Recently news came from Google that the search engine giant is in a mood to phase out the SHA-1 algorithm in its upcoming chrome browser version. We know that SHA-1 is still in use in many applications, protocols. However, due to some technical weakness SHA-1 seems unreliable and insecure against potential collision attack. After the announcement of Microsoft, Google and Mozilla also join the migration movement. Below we have gathered giants’ reviews and social media reactions to this movement.

About announcement of SHA-2 Migration:

According to Google Announcement, from November 2014, Google Chrome will start to cease support to SHA-1 algorithm in upcoming chrome versions -39, 40, and 41. Even Microsoft and Mozilla Firefox have already notified about retiring the SHA1 algorithm because SHA1 is susceptible to collision attack.

What Microsoft Says about SHA-1:

On Tuesday, Nov 12, 2013, Microsoft advisory commented on retiring SHA-1 algorithm.
“Since 2005 there have been known collision attacks (where multiple inputs can produce the same output), meaning that SHA-1 no longer meets the security standards for a producing a cryptographically secure message digest,"

Google’s announcement about SHA-1:

Google lately, but wisely took steps for SHA-1 migration and announced that “We plan to surface, in the HTTPS security indicator in Chrome, the fact that SHA-1 does not meet its design guarantee. We are taking a measured approach, gradually ratcheting down the security indicator.”

Mozilla’s announcement on SHA-1:

Mozilla declared in announcement “We plan to add a security warning to the Web Console to remind developers that they should not be using a SHA-1 based certificate. We will display an additional, more prominent warning if the certificate will be valid after January 1, 2017, since we will reject that certificate after that date.”

Browser Warnings after Dec. 2016:

After Google’s announcement, the following types of errors will upcoming Chrome versions produce over a specific period:

  • Chrome 39 (probably release on 26 Sep 2014) will show a yellow padlock in the browser, and believe as “secure, but with minor errors” whose site certificate expires on or after 1 January 2017.
  • Chrome 40 (probably release on 7 Nov 2014) will show a blank page icon in the browser and deem as “neutral, lacking security” whose site certificate expires between 1 June 2016 and 31 December 2016.
  • Chrome 41 (probably release in Q1 2015) will show a lock with a red X in the browser and deem as “affirmatively insecure” whose site certificate expires between 1 January 2016 and 31 December 2016.

Check Your Website Now!