When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient?

This question arose because somewhere it was stated that a site used weak protection because of sha1. But that site also showed a sha256 fingerprint.

Is it possible that because of also having sha1 that that counts as the weakest link for spoofing, man-in-the-middle etc.? (or in other cases md5 as weakest link).


1 Answer 1


The browser checks both fingerprints. The idea behind that is if it is possible to create a fake certificate with the same MD5 or SHA-1 hash, there is a much lower (almost zero) probability the same certificate second hash also matches. This could be called: Dual Hash Fingerprinting. Both MD5 and SHA-1 are considered vulnerable in theory (MD5 also in practice). This is one reason to move to SHA-1/SHA-256. Even if a collision is possible for SHA-1, it is almost impossible to get the same collision for SHA-256.

A note here, is that longer fingerprints may be truncated and SHA-256 has longer fingerprint than SHA-1 and the same with SHA-1 and MD5.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.