{"id":566,"date":"2017-01-16T11:08:59","date_gmt":"2017-01-16T11:08:59","guid":{"rendered":"https:\/\/www.sslrenewals.com\/blog\/?p=566"},"modified":"2021-11-25T08:34:41","modified_gmt":"2021-11-25T08:34:41","slug":"google-will-show-error-in-chrome-56-for-sha1-certificates","status":"publish","type":"post","link":"https:\/\/sslrenewals.com\/blog\/google-will-show-error-in-chrome-56-for-sha1-certificates","title":{"rendered":"Google will Show Error in Chrome 56 for SHA1 Certificates"},"content":{"rendered":"

Starting January 2017, SHA-1 Support will be eliminated from popular browsers<\/h2>\n

SHA-1 is over. Starting in January 2017, Google Chrome \u2013 and soon after, the rest of the browser community \u2013 will remove SHA-1 support and start making websites that still use SHA-1 SSL Certificates as not secure.<\/p>\n

This move has been a long time coming.<\/p>\n

SHA-1 was the industry-standard hashing algorithm from 2011-2015, this despite the warnings of numerous security experts that SHA-1 was vulnerable to certain types of attacks. In early 2016 SHA-2 replaced SHA-1 as the industry standard. Since then, all certificates must be issued with SHA-2 and the browser community had begun to set deadlines to SHA-1 deprecation.<\/p>\n

That deadline is now.<\/p>\n

Unfortunately, not all companies and organizations are ready for the change. Per Venafi VP of Security Strategy Kevin Bocek:<\/p>\n

\n

There\u2019s still a lot of work to be done. Large businesses are coming to us that either have not started yet, or have tried to start and did not make great progress\u2026 Much of it is that teams just don\u2019t know where to start.<\/q><\/em><\/p>\n<\/blockquote>\n

Venafi offers crypto-related services and solutions to enterprise level clients. Per the company\u2019s research, 35% of the web still uses SHA-1 certificates.<\/p>\n

\"Google<\/p>\n

For many businesses, the migration issues are related to infrastructure: they are still using legacy systems and devices that cannot support SHA-2. In this case, the cost of upgrading that much infrastructure can be prohibitive.<\/p>\n

Fortunately, there\u2019s a workaround. If a company or organization acts quickly, it can still make sure of a protocol in Chrome 54 that will allow it to make use of SHA-1 support through January 1, 2019.<\/p>\n

In order to do this site admins must make use of the \u201cEnableSHA1ForLocalAnchors\u201d policy. Google will still distinguish between certificates chained to a public certificate authority and those chained to local CAs.<\/p>\n

Per a member of the Google Chrome security team, Andrew Whalley:<\/p>\n

\n

We recognize there might be rare cases where an enterprise wishes to make their own risk management decision to continue using SHA-1 certificates\u2026 Features which require a secure origin, such as geolocation, will continue to work, however pages will be displayed as \u2018neutral, lacking security.\u2019 Without this policy set, SHA-1 certificates that chain to locally installed roots will not be trusted starting with Chrome 57, which will be released to the stable channel in March 2017\u2026 Note that even without the policy set, SHA-1 client certificates will still be presented to websites requesting client authentication.<\/q><\/em><\/p>\n<\/blockquote>\n

However, companies and organizations that wish to make use of Google\u2019s SHA-1 provision need to be aware that this support is not guaranteed. Google reserves the right to remove support before the 1-1-19 deadline in the event of a major cryptographic break of SHA-1.<\/p>\n

So while this provision buys some time, it\u2019s still imperative that you hurry up and migrate to SHA-2.<\/p>\n

SHA-1 is officially over.<\/p>\n

\"Google<\/p>\n

\"Google<\/p>\n\n\n

Related Post:<\/strong><\/h3>\n\n\n\n