Taken from here:
Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them.
Why are the signatures not used? Are not root certificates vulnerable too? Is there nothing that can be gained from breaking SHA1 to fake a root cert?