This question already has an answer here:
My understanding is that SHA1 is pretty much considered obsolete.
Yet, I just opened the Trusted Root Certificate Authorities on my Windows 10 computer and I see that most Trusted Root Certificate Authorities use SHA1 certificates, most expiring well into the 2030's.
This includes root CAs from Verisign, thawte, GeoTrust, DigiCert... etc.
My understanding is also that any certificate issued by a CA will automatically have the same hash algorithm and bits as the root CA, so doesn't this ultimately mean our computers are set to blindly trust something that uses a now considered obsolete hash?
I understand that whether any certificates issued by these CAs are still in use or not is a completely different thing altogether, but why do we just blindly trust them (the CAs and ultimately their issued certs) to begin with?
In fact, some root CAs still use MD5...