I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must withstand attack for 10 to 30 years.
As far as I know, 1024-bit RSA provides about 80-bits of security due to advances in integer factorization and the number field sieve. 80-bits of security is out of reach of most attackers.
SHA-1 provides about 61-bits of security due to Marc Steven's HashClash. 61-bits of security is well within the reach of many attackers, especially when compute time is so inexpensive on Amazon's EC2 or OpenStack's Nova.
Two real life attacks on crypto I am aware are (1) Texas Instruments signing key, which factored a 512-bit key; and (2) Flame, which exploited collisions on weak/wounded signing algorithms. From TI, we know the attacker will attempt to factor a key with 60 or so bits of security. And from Flame we know the attacker will attack the digest function when its effective security is around 60 bits or so.
Why did browsers deprecate CAs and Subordinate CAs with 1024-bit RSA, but retain SHA-1?