1

Q: Should I update my SHA-1 certificates? If so, how?

Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been attributed to Google sunsetting SHA-1. A few comments here suggest getting the certificate re-issued in SHA-2.

How do I get the certificate re-issued? Without much knowledge in web security, I'd prefer to hear it from a trusted source (here), as opposed to following instructions from some website I don't know I can trust.

Edit:

Take Wikipedia: clicking the https in chrome, I see I'm using SHA-1 via a certificate GlobalSign Organization. But shaaaaaaaaaaaaa.com/check/wikipedia.org suggests that Wikipedia does have an SHA-2 certificate, so I don't think this is an issue with Wikipedia. How do I use the other?

I have verified the browsers are up to date, and cache is cleared, Firefox is using the same certificate as Chrome. However, the current certificate used is signed by GlobalSign, the one on the shaaaa website is signed by SSL Labs.

|improve this question
  • 4
    If I understand your question correctly, this is not about servers you own? But for sites that you just browse? – BadSkillz Jul 22 '15 at 7:45
  • @BadSkillz - correct: browsing, not hosting. – anon01 Jul 22 '15 at 13:39
  • 1
    In that case there is nothing you can do besides from emailing the owners of those sites and tell them their certificates are still using an obsolete hashing algorithm. They should then have a look at the answers below :) – BadSkillz Jul 22 '15 at 13:45
  • @BadSkillz take Wikipedia: clicking the https in chrome, I see I'm using SHA-1 via a certificate GlobalSign Organization. But shaaaaaaaaaaaaa.com/check/wikipedia.org suggests that wikipedia does have an SHA-2 certificate, so I don't think this is an issue with wikipedia. How do I use the other? – anon01 Jul 22 '15 at 14:05
  • No idea how that could happen... Did you try it in another browser? Is chrome up-to-date? Clear cache? – BadSkillz Jul 22 '15 at 14:22
1

As a user/client, you can revoke a certificate only if it contains the same subject name as the certificate presented for authentication. You can do that using the revocation form provided in the end-entities page. Otherwise only if you are a CA administrator or a Certificate Manager you can do it by yourself.

Implement Role-Based Administration:

  • CA administrator: Configure and maintain the CA. This is a CA role and includes the ability to assign all other CA roles and renew the CA certificate. These permissions are assigned by using the Certification Authority snap-in.
  • Certificate manager:Approve certificate enrollment and revocation requests. This is a CA role. This role is sometimes referred to as CA officer. These permissions are assigned by using the Certification Authority snap-in.

Your CA can reissue your certificate with SHA-2 signature because, as mentioned in your link, SHA-1's use on the Internet has been deprecated since 2011 and:

HTTPS sites whose certificate chains use SHA-1 and are valid past 1 January 2017 will no longer appear to be fully trustworthy in Chrome’s user interface.

|improve this answer
  • that's good information, but I'm looking for a practical answer. What specific steps do I need to take to get/connect with a sha-2 certificate (as a browser, not server that is)? – anon01 Jul 22 '15 at 15:22
0

Certificates can't be changed after they are created, but you can always create/request another.

Talk to the company that created your certificate (e.g GoDaddy) and says you want them to revoke your old certificate and issue a new one they will probably create another with SHA2 by default.

|improve this answer
  • To get a SHA2 certificate you need to generate the correct CSR, for instance with openssl you need to add the option -sha256. This is not done by the provider. – BadSkillz Jul 22 '15 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.