EDIT: I have edited my question to not only consider SHA-1 deprecation, but more general the direct signing of subscriber certificates from root.
In case a legacy system still uses a setup whereby a self-signed, internal root CA directly issues server certificates, will these certificates still be accepted by end-user's browsers (e.g. employees)?
I am thinking about the impact of:
- SHA-1 deprecation: if I have the SHA-1 root directly issue SHA-256 subscriber certs, is this allowed? I know that the signature on the root is not used, but directly issuing certificates from roots might be considered an illegal set-up.
- Other measures that are taken by browsers: for example the document I was linked to by CryptoGuy mentioned "CAs MUST NOT issue Subscriber Certificates directly from Root CAs."
Please also provide links to credible sources, if available.