Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.

  • you can't make a blanket statement like "sha1 is not secure"; it depends on why and how it's used. Some applications are indeed "broken", which is why it's easier to dismiss than figure out risks, but not all uses are bad. – dandavis Oct 12 '18 at 17:06

There is no "SHA1 with RSA encryption" for certificates used in SSL. In the context of certificates the owner of the certificate has a key pair (RSA, ECC...) and here the public key part is included in the certificate, SHA1 (or other hash algorithms) are used as a cryptographic hash within the signature and the private key (RSA, ECC..) of the issuer certificate is used in this signature too (for signing, not encrypting).

SHA1 is no longer considered secure for use in certificate signatures - use SHA2 (i.e. SHA256, SHA384... etc) instead.

  • |-Subject : C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA |-Signature Algorithm : SHA-1 With RSA Encryption – Veeru Oct 11 '18 at 11:51
  • Hi is this secure? – Veeru Oct 11 '18 at 11:51
  • 1
    @Veeru: While you don't provide all details about the certificate this is likely this root certificate. Signature for root certificates is irrelevant. See Why is it fine for Certificates above the end-entity certificate to be SHA1 based?. – Steffen Ullrich Oct 11 '18 at 12:21
  • 1
    Sadly the early versions of PKCS1 were written before the importance of distinguishing signature from encryption semantics was fully understood, so the (now retronymed SSAv15) signature OIDs were and remain officially named {hash}withRSAEncryption -- see tools.ietf.org/html/rfc8017#appendix-A.2.4 -- and even TLS1.3 still allows SSAv15 in certs although protocol-level RSA signature is changed to PSS. – dave_thompson_085 Oct 12 '18 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.