FAQ Hero

SHA-2 (SHA-256) compatibility and migration

Why SHA-2 matters (vs SHA-1)

HA-2 (for example, SHA-256) is the modern family of hashing algorithms used to sign certificates and verify data integrity; SHA-1 has been deprecated because of practical collision attacks and is no longer acceptable for secure certificate signatures. Transitioning to SHA-2 often requires inventorying existing certificates and signing keys, assessing client and device compatibility, and updating systems that expect SHA-1 signatures (browsers, legacy devices, embedded systems). Failure to migrate can cause browser warnings, client incompatibility, and security exposure. DigiCert maintains clear guidance and tooling to identify SHA-1 usage, issue SHA-2 replacements, and help customers update systems with minimal disruption.

What is SHA-2? 
SHA-2 is the family of secure hashing algorithms (including SHA-256) used for certificate signatures and other cryptographic hashing.

Is SHA-1 still safe?
No — SHA-1 is deprecated and should be replaced with SHA-2 for certificates and signatures.

How do I migrate to SHA-2? 
Inventory certificates, identify affected systems, issue SHA-2 replacements, and update clients/servers to accept SHA-2-signed certificates.

Does DigiCert issue SHA-2 certificates? 
Yes — DigiCert issues SHA-2 (e.g., SHA-256) certificates and publishes compatibility and transition guidance.

  • DigiCert Logo

    The most-trusted global provider of high-assurance TLS/SSL, PKI, IoT and signing solutions.