I have installed a clean Win7 machine on a network where my own PC is connected. When I navigate to google.com from my PC (Win 8.1) I receive proper valid TLS connection. Yet when I navigate to google.com from the Win7 machine I get an error which says: "This page is insecure (broken HTTPS)" and after that a warning about a SHA-1 certificate.

Why is this happening? What is the difference in the certificate of each machine?

  • What does iexplore report? What does Firefox report? What does Chrome report? – StackzOfZtuff Jan 24 '17 at 9:13
  • Show us the certificate chain and details for the leaf certificate presented to the respective systems. – a CVn Jan 24 '17 at 9:40
  • I think google chooses its cert based on which client it thinks you're using. Perhaps it uses a SHA1 cert because it thinks that your client doesn't support anything newer. – CodesInChaos Jan 24 '17 at 10:34
  • @CodesInChaos That presents pretty much the same problem that I am asking about in How can different paths on the same domain have different TLS encryption? (which is as of yet unanswered, hint hint). – a CVn Jan 24 '17 at 15:14

What is likely happening is that Google decides that your browser / system doesn't have the right trust point (root CA's) installed. No doubt Windows 7 supports SHA-2 - that is SHA-256 / SHA-512 and possibly more.

However, if you still have CA certs that contain just SHA-1-based signatures or if you have CA certs that only issued SHA-1 certificates (to Google) then the verification of the certificate chain depends on SHA-1.

You can easily click on the lock icon to go to the certificates, then to Certification Path and then finally view each certificate and look for SHA-1. You can ignore the "thumbprint algorith" as the thumbprint is calculated locally on your machine; it's not part of the certificate itself.

This should explain the warning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.