How to Migrate to SHA-2 SSL Certificates

Find and Replace Internal and External SHA-1 Certificates

As your security partner, DigiCert has already made SHA-256 the default for all new SSL Certificates issued, and strongly recommends that all customers re-key their SHA-1 certificates to avoid possible warnings online due to the phase out of SHA-1 trust by Microsoft, Google, and Mozilla.

Quickly Find and Replace SHA-1 Certificates

Certificate Inspector and the SHA-1 Migration Tool help you quickly find and replace SHA-1 SSL Certificates with a free DigiCert SHA-2 certificate.

Check My Site

Important Dates

As part of their SHA-2 migration plan, Microsoft, Google, and Mozilla have announced that they will stop trusting SHA-1 certificates. Google will begin phasing out trust in SHA-1 certificates in November 2014.

Microsoft and Mozilla will begin phasing out trust for SHA-1 certificates in 2016. With these dates fast approaching, it’s time to move to SHA-2.

November 2014 - SHA-1 SSL Certificates expiring any time in 2017 will show a warning in Chrome.

December 2014 - SHA-1 SSL Certificates expiring after June 1, 2016 will show a warning in Chrome.

January 2015 - SHA-1 SSL Certificates expiring any time in 2016 will show a warning in Chrome.

January 1, 2016 - Microsoft will end trust for SHA-1 Code Signing Certificates without time stamps.

January 1, 2017 - Microsoft and Mozilla will end trust for all SHA-1 SSL Certificates.

Benefits of SHA-256 SSL Security

Google, Microsoft, and Mozilla have will end trust for SHA-1 certificates by 2017.

SHA-2 is a cryptographic hashing algorithm developed by the National Institute of Standards and Technology (NIST) to replace SHA-1. The NIST required that all Federal Agencies stop using SHA-1 certificates by January 1, 2011 due to mathematical weaknesses in SHA-1.

Network security experts have warned that SSL Certificates using the SHA-1 hashing algorithm are in danger of being hacked due to advancements in computing technology.

DigiCert recommends moving to SHA-2 for security reasons. Most major platforms support SHA-2 and the majority of organizations should not experience issues upgrading to SHA-2.

Should I Switch to SHA-2?

W3Schools reports that 59.8% of all Internet users use Chrome and will be affected by the SHA-1 warnings starting in November. In order to avoid warnings for Chrome users, administrators must replace any SHA-1 certificates with SHA-2.

In November 2013, Microsoft announced that it would stop trusting SHA-1 certificates due to concerns that the algorithm is no longer secure. It stated that the deadlines in the SHA-1 deprecation policy reflected their estimation of the likelihood of the threat from SHA-1 attacks. Mozilla has announced a similar timeline for its products.

In August 2014, Google took an even more aggressive stance stating that Chrome will display warnings starting in November 2014 for sites secured with SHA-1 certificates due to SHA-1 being insufficiently secure. Google’s intent is to help phase out SHA-1 certificates on an accelerated timeline and make the transition smoother than MD5.

Security Problems with SHA-1

As technology advances and attacks become more sophisticated, it makes sense that eventually a hash function’s collision resistance will become weak enough that a stronger hash function becomes necessary.

Once existing computation power is strong enough and the cost of gathering this computation power becomes practical, an industry-wide move must be made to a stronger hash algorithm—as was the case with MD5.

Taking into account the need for system compatibility, the industry has been gradually shifting toward SHA-2 over the last few years to mitigate the future threats to the SHA-1 algorithm.