I understand that most commercial browsers will stop trusting websites with SHA-1 PKI certificates by Jan 2017 so it is critical for websites to update to SHA-2 by that time. My question is, is it also critical for end-users to update their personal PKI certificates to SHA-2 by Jan 2017 to still be able to authenticate themselves to websites requiring certificate-based authentication? That is, will the browsers also stop supporting sending of SHA-1 certificates to websites during mutual authentication?


Web browsers will accept SHA-1 client authentication certificates. However, Web server may reject this certificate if authentication server (domain controller, for example) does not support SHA-1.

I think that most authentication servers will accept SHA-1 client certificates (at least Active Directory will do), because they are not subject of depreciation policy, but I would strongly recommend to upgrade your CAs to sign certificates with SHA-2.

  • Could you include some reference to support the answer? It's about future, so not easily verifiable now. – techraf Aug 5 '16 at 6:31
  • For example, Microsoft's SHA-1 depreciation policy : aka.ms/sha1 – Crypt32 Aug 5 '16 at 6:33
  • And which part exactly does prove (or even suggest) the client certificates with SHA-1 will be supported? I can see only TLS Certificates - 2/14/2017 - Windows trusts SHA-2 only under Schedule. – techraf Aug 5 '16 at 6:39
  • Thanks. So for me, as an owner of a website that requires certificate based authentication, it is a MUST that I upgrade my site to serve SHA-2 certificate after 2016. If my web server is configured to accept SHA-1 client certificates, it is NOT required for my users to upgrade to SHA-2 client certificates even after 2016. So in a mutual authentication, it is possible for the server to serve a SHA-2 cert and accept a SHA-1 cert. Is that correct? – Raged Aug 5 '16 at 6:43

As far as I know, creating collisions for SHA1 hashes for certificates is theoretically possible but it still requires ~2^61 SHA compression (according to this paper from 2011). I don't know if there is more recent research on this topic with different results. The complexity of 2^61 means that only the most powerful players like NSA, etc. can produce a certificate that has the same hash as yours. If you are a high value target, then you should issue a new certificate but if you were you probably wouldn't have posted on this site.

  • 4
    That's not true. Collision attacks are not the same as pre-image attacks, and pre-image attacks are still infeasible against SHA1. (Although you still should be moving towards more secure hashes.) – Awn May 2 '17 at 15:16
  • Preimage attacks are also infeasible against MD5, but you shouldn't be using it either! – forest Mar 29 '18 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.