15

For the script at the bottom of this post, Firebug reports the following error:

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1

The error is duplicated for every call to googleapis, and does appear for links to resources on my server (i.e. clicks.js).

https://www.ssllabs.com indicates that I am using SHA256withRSA.

oppenssl also indicates that I am using sha256WithRSAEncryption.

[root@devserver ~]# openssl req -in /etc/pki/tls/private/mysite_csr.pem -noout -text
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=US, ST=Washington, L=Bothell, O=MySite, CN=mysite.com/emailAddress=xxx@comcastdotnet
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Modulus:
                    xxxx
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         xxxx
[root@devserver ~]#

It occurs both with self-signed certificates as well as those from a CA.

The script which causes the error is below along with the Firebug errors.

<!DOCTYPE html>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
        <title>Testing</title>  
        <link href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/themes/ui-lightness/jquery-ui.css" type="text/css" rel="stylesheet" />
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.js" type="text/javascript"></script>
        <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.js" type="text/javascript"></script>
        <script src="clicks.js" type="text/javascript"></script>
    </head>

    <body>
    </body> 
</html> 

enter image description here

Left clicking to copy the errors provides the following:

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/themes/ui-lightness/jquery-ui.css
Line 0

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.js
Line 0

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/jquery-ui.js
Line 0

What causes this error, and how is it eliminated?

7

The problem isn't your certificate, it's the certificate of googleapis.com, which you're accessing by way of loading their jQuery libraries.

If you go directly to one of the scripts, you can click on the padlock icon and see more information about the SSL certificate:

+- GeoTrust Global CA
+--- Google Internet Authority G2
+----- *.storage.googleapis.com
     +--- Certificate Signature Algorithm: PCKS #1 SHA-1 With RSA Encryption

I wouldn't worry too much about it - Google are hoping to move forward to SHA256 soon, and it's hardly likely to affect you.

If you're really worried about it, move the copies of jQuery over to your site locally, then include them from there. That way you're not fetching resources from 3rd party hosts.

  • All that said, I haven't quite worked out why a certificate with a common name of *.storage.googleapis.com is considered correct for the domain ajax.googleapis.com... – Polynomial May 18 '15 at 14:12
  • Ah - I worked it out. The certificate has a list of Subject Alternative Name records, including *.googleapis.com. For some reason Google chose to set the storage domain as the CN. – Polynomial May 18 '15 at 14:19
  • Thanks! This was driving me crazy! At least I learned a lot in the process (got rid of SSLv3!) – user1032531 May 18 '15 at 14:20
  • I see these a lot with with SHA1 root certificates... "SHA-1-based signatures for trusted root certificates are not a problem because TLS clients trust them by their identity, rather than by the signature of their hash.”.. Still annoying. – ficuscr Jul 30 '15 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.