1

I am confusing regarding SHA-1 deprecation.

We use self-signed certificates signed with SHA1 and the expiration is after 1 January 2017.

According to this blog: http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx

CAs must stop issuing new SHA1 by 1 January 2016. … For SSL certificates, Windows will stop accepting SHA1 end-entity certificates by 1 January 2017. This means any time valid SHA1 SSL certificates must be replaced with a SHA2 equivalent by 1 January 2017.

Will our self-signed certificates stop to work on 1 January 2016 or stop to work on 1 January 2017?

Added

Just to clarify: If I will issue self-signed certificates signed with SHA1 after 1 Jan 2016 it will not accepted by browsers. Correct?

Added 2

I can work with self-signed certificates. Browsers warn about trust problem but allow me to connect (see images below).

Question if we will issue self-signed certificates signed with SHA1 after 1 Jan 2016 will it continue to work on the same way?

Chrome with self-signed certificates

FF with self-signed certificates

IE with self-signed certificates

Improve this question

4 Answers 4

Reset to default
3

The article you linked to is only relevant for CAs participating in the Windows Root CA Program, not self-signed certs.

Self-signed certs only work if you put them as a trusted CA root in OS or browser. These will continue to work indefinitely.

Windows Root CA Program certs signed with SHA1 are good to 1 Jan 2017.

1 Jan 2016 is the last issue day that SHA1 certs will be accepted. 1 Jan 2017 is when SHA1 certs, whenever they were issued, become invalid.

This is for SSL certs that are not on Windows Vista and Windows Server 2008. Code signing certs have a different schedule.

(Thanks to @bayo15 for comment about self-signed certs being different.)

Improve this answer
4
  • Just to clarify: If I will issue self-signed certificates signed with SHA1 after 1 Jan 2016 it will not accepted by browsers. Correct?
    – Michael
    Aug 18, 2015 at 15:38
  • @Michael Browsers don't accept self-signed certificates at all. You have to add them as a Trusted CA Root (i.e in the OS, or for firefox separately to it's own trusted list). If you mean certificates signed by a commonly trusted CA, they should accept all SHA1 certs until 1 Jan 2017.
    – bayo
    Aug 18, 2015 at 16:02
  • 1
    Good clarification @bayo15 - I updated my answer.
    – Neil Smithline
    Aug 19, 2015 at 1:31
  • I can work with self-signed certificates. Browsers warn about trust problem but allow me to connect
    – Michael
    Aug 19, 2015 at 7:57
2

In reply to the Added 2 part.

Yes. It will be the same after 1 Jan 2016 and even after 1 Jan 2017. You can always click through this warning and tell the browser to ignore it (it is somewhat harder with HSTS, but thats another story).

Improve this answer
0

You will need to replace it before January 2017 with a SHA-2 in order for Windows/browser clients to accept the certificate.

Improve this answer
0

Self-signed certificates with SHA-1 signature will continue to work in the sense that http traffic between client and server will continue to be encrypted.

Browsers have always flagged self-signed certificates because the certificate has not been digitally signed by a trusted Certificate Authority.

Starting in June 2016 Internet Explorer will now also flag certificates that are issued by a trusted certificate authority but are signed only with the SHA-1 algorithm. See TechNet article on Windows Enforcement of Authenticode Code Signing and Timestamping

In your case you will continue to see the same warnings in the browser.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .