Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient?
This question arose because somewhere it was stated that a site used weak protection because of sha1. But that site also showed a sha256 fingerprint.
Is it possible that because of also having sha1 that that counts as the weakest link for spoofing, man-in-the-middle etc.? (or in other cases md5 as weakest link).
The browser checks both fingerprints. The idea behind that is if it is possible to create a fake certificate with the same MD5 or SHA-1 hash, there is a much lower (almost zero) probability the same certificate second hash also matches. This could be called: Dual Hash Fingerprinting. Both MD5 and SHA-1 are considered vulnerable in theory (MD5 also in practice). This is one reason to move to SHA-1/SHA-256. Even if a collision is possible for SHA-1, it is almost impossible to get the same collision for SHA-256.
A note here, is that longer fingerprints may be truncated and SHA-256 has longer fingerprint than SHA-1 and the same with SHA-1 and MD5.
Basic TLS Handshakein this link - en.wikipedia.org/wiki/Transport_Layer_Security