Do SSL/TLS clients warn on weak keys/hashes regarding self-signed certificates?

Question

In the last few months/years, SSL/TLS clients such as web browsers normally display warnings on server certificates with low-bit keys and weak hashing algorithms. This is most certainly the case for certificates signed by major CAs. Do the same warnings get displayed for certificates signed by a self-signed CA when the CA certs have been added to the certificate store?

I'm well aware that the behavior depends purely on the client software at hand, but I'm primarily wondering about major web browsers (Firefox, Chrome, IE, etc...)

Answer 1

If the self signed has been added to the certificate store the OS/Browser will treat like any other certificate and display any warnings regardless.

Answer 2

Most browser will warn on vulnerable TLS/SSL certificate, e.g. using sha1 to sign the cert.

You can try out your browser using badssl.com example for bad and vulnerable certificate error.

(update) To test your self-signed certificate error, you can use download the github source of badssl and generate the test page.

Answer 3

Thank you all for your answers. I let curiosity get the better of me, and actually tested it for myself (which I was trying to avoid in the first place). I hope others find these results useful.

As you can see, with the exception of IE, Firefox and Chrome will warn about weak hashing algorithm usage, but completely ignore the issue of 1024bit keys.

Tested July 3, 2017

Case 1: 1024bit key, MD5, no subjectAltName
-------------------------------------------------------
Firefox = Warning that cert is hashed with disabled algorithm (MD5) 
Chrome = Warning that cert is missing subjectAltName
IE = no warning


Case 2: 1024bit key, MD5, subjectAltName same as subject CN
-------------------------------------------------------
Firefox = Warning that cert is hashed with disabled algorithm (MD5) 
Chrome = Warning that cert is hashed with weak algorithm (MD5)
IE = no warning


Case 3: 1024bit key, SHA256, no subjectAltName
-------------------------------------------------------
Firefox = no warning
Chrome = Warning about certificate missing subjectAltName
IE = no warning


Case 4: 1024bit key, SHA256, subjectAltName same as subject CN
-------------------------------------------------------
Firefox = no warning
Chrome = no warning
IE = no warning


[1] Browser versions tested:
  * Firefox 54.0.1
  * Chrome 59.0.3071.115
  * IE 11.0.9600.18698
[2] All tests performed on Windows 8.1 32-bit OS
[3] All server certificates signed by a self-signed Root CA,
    with no Intermediate CA. Root CA certificate was installed
    into the Windows certificate store using mmc.exe, and
    Firefox using the Options GUI.