1

What the impacts of the SHA-1 deprecation will be on internal/intranet self-signed certificates?

Will this impact/stop internal/intranet HTTPS service such as web interfaces?

  • 2
    For Microsoft policy refer to aka.ms/sha1, they will support SHA1 for private certificates for some time. – Crypt32 Aug 19 '16 at 6:21
1

As an organization, you typically have control on the policies implemented in your infrastructure, this includes policies governing the behavior of client software regarding certificate handling.

I am assuming you discuss the classic browser - web service relationship. With this in mind, take a look at the two main player's statements on this matter:

https://blogs.windows.com/msedgedev/2016/04/29/sha1-deprecation-roadmap/

https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html

Even so, depending on the type/version of your clients, enforcement of bypass policies may be possible. Not that this would be an advisable course of action.

  • Thanks Dotproi! You're information and references is perfect. Thank you heaps, i shall take a read. I am just concerned that if i dont update my certificates my wireless accessible other device web interface will stop working. I am a noob at this topic and i appreciate you proving me your insight. – user121833 Aug 21 '16 at 23:39
  • 1
    Creating a new certificate that meets current policies is the very best option. Second best is to keep a vm with the latest version of your web browser that will not block that specific cert and utilize it strictly to access your wireless device, ideally these administration tasks will be performed while said device is not connected to an external network. There are several sites that offer outdated versions of typical browsers, modern.ie comes to mind. – dotproi Aug 21 '16 at 23:50
0

None. Self-signed certificates are by definition not trusted by external CA, so vulnerability which allows one to impersonate CA is meaningless - attacker could just put any fake CA and your clients which ignore CA would trust it... (The same is NOT true if you use your own trusted CA, of course)

  • Thanks Majija for the reply much appreicated. Sorry for such a dumb question. My knowledge within security/certificates isn't the greatest but your answer has provided me with guidance and further insight into find the answer i'm seeking. I ask this question as, i dont run any external facing services, i just don't want my internal web application interface such as wireless access point weblogins to do cease working. Excuse my ignorance. – user121833 Aug 21 '16 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.