search

konklone / shaaaaaaaaaaaaa

Check if a website has weak SHA-1 TLS certificates.
https://shaaaaaaaaaaaaa.com
BSD 3-Clause "New" or "Revised" License
207 stars 27 forks source link

Give advice on SHA1 vs SHA256 root #79

Closed alexjurkiewicz closed 5 years ago

alexjurkiewicz commented 9 years ago

RapidSSL now offer this choice for Hashing Algorithm:

screen shot 2015-09-18 at 1 08 15 pm

I would like this website to offer advice on what the difference is and which one I should pick. I assume we want to use the SHA1 root for compatibility but I don't know how prevalent the SHA256 root is and when there will be problems with using the SHA1 root (eg chrome address bar deprecation).

konklone commented 9 years ago

I'm not sure what the compatibility difference will be, but I think you're likely to be fine either way, unless you have a truly globally large and diverse userbase of people and devices.

The SHA-1 root won't have an impact on Chrome address bar deprecation stuff, as Chrome ignores the signature on the root certificate.

If you find any more information about this, I'd love for you to come back and let us know. You may also find some help in this thread: https://github.com/konklone/shaaaaaaaaaaaaa/issues/24