In the original post on the subject they said that in Chrome 41:

Sites with end-entity certificates that expire on or after 1 January 2017, and which include a SHA-1-based signature as part of the certificate chain, will be treated as “affirmatively insecure”. Subresources from such domain will be treated as “active mixed content”.

The current visual display for “affirmatively insecure” is a lock with a red X, and a red strike-through text treatment in the URL scheme.

I did some upgrades to beat the deadline, but left the old certificate on one less-important server so I could observe this new failure mode for myself when Chrome 41 came out.

Chrome 41 is stable now, and I don't see the red X with strike-through, just the "neutral" icon that is used for unencrypted http. Clicking on that icon gives the warning about "outdated security settings", and the certificate information includes:

Signature algorithm   sha1RSA
Valid to              Tuesday, June 13, 2017 7:59:59 PM

Chrome 39 showed the "padlock with warning triangle" icon, and 40 showed the "neutral" icon, just as the original announcement promised. But 41, instead of taking the next step, seems to be doing the same thing as 40.

I can't find any updated announcement from Google. Did they slow down the deprecation schedule?


1 Answer 1


Chrome 42 has now been released, and I can answer my own question: yes, they must have slowed down. 42 has the behavior that was expected in 41. I'm still not aware of any official explanation or acknowledgement of the delay.


You must log in to answer this question.