Just curious - if I'm using an end-entity (leaf) certificate that has a SHA-1 signature, does that mean that ALL certificates in the chain also must use SHA-1?

  • 2
    The reverse is going to be a part of the migration away from SHA1 in certificates. A certificate that uses a SHA1 digest algorithm can issue a certificate that uses SHA256. Migrating to SHA256 doesn't do any good unless all intermediates are also SHA256.
    – vcsjones
    Oct 23, 2014 at 18:14

1 Answer 1


Yes it can. The algorithm used for signing a certificate by the issuer is independent from the algorithm which was used to sign the issuers certificate itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .