This question already has an answer here:
I was wondering whether SHA-1 deprecation would create any security concern for self signed (internally used) already existing certificates. What is the right thing to do in this case? Since the discovered vulnerability does not allow an attacker to create another document with the same hash as an already existing document organizations using already existing certificated should not be effected, right?
Should the SHA-1 hash algorithm still be allowed for this scenario?