SC-097: the last SHA-1 signatures leave the Web PKI

SC-097 finishes the long retirement of SHA-1 in publicly trusted TLS. From 2026-09-15, CAs may not sign new CRLs with SHA-1, and any unexpired intermediate CA certificate that still carries a SHA-1 signature must be revoked.

What changed

SC-097 updates §7.1.3.2.1 of the Baseline Requirements to prohibit SHA-1 signatures in certificates and status information, and requires the remaining SHA-1 subordinate CA certificates to be revoked. It is the last of several steps: Ballot 118 (2014) stopped the issuance of new subscriber and subordinate CA certificates signed with SHA-1, and SC-053 (2022) ended SHA-1 for delegated OCSP signing. The ballot text notes that unexpired, unrevoked subordinate CA certificates with SHA-1 signatures still existed, and that some CRLs disclosed to the CCADB were still signed with SHA-1. SHA-1 stays allowed for the issuerNameHash and issuerKeyHash fields in OCSP requests, as RFC 5019 requires. Google's Chrome Root Program proposed it; Apple and HARICA endorsed it.

Effective dates

The BR change took effect on 2026-02-25. The CRL ban and the revocation deadline apply from 2026-09-15; as of November 2026 both are in force.

Who is affected

SC-097 affects CAs with old hierarchies. Website certificates were already SHA-256 or better; a revoked SHA-1 intermediate only matters if a server still sends an outdated chain containing one.

What to do

Make sure your server sends the current chain from your CA. Inspect each certificate in the chain with the certificate decoder and replace any SHA-1 signed intermediate.