# SC-097: the last SHA-1 signatures leave the Web PKI

> SC-097 bans all remaining SHA-1 signatures in TLS certificates and CRLs and orders revocation of unexpired SHA-1 subordinate CAs from 2026-09-15.

Source: https://ssl.sh/ballots/sc-097/
Last updated: 2026-11-10

SC-097 finishes the long retirement of SHA-1 in publicly trusted TLS. From 2026-09-15, CAs may not sign new CRLs with SHA-1, and any unexpired [intermediate CA certificate](https://ssl.sh/glossary/intermediate-certificate/) that still carries a SHA-1 signature must be revoked.

## What changed

SC-097 updates §7.1.3.2.1 of the [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/) to prohibit SHA-1 signatures in certificates and status information, and requires the remaining SHA-1 subordinate CA certificates to be revoked. It is the last of several steps: Ballot 118 (2014) stopped the issuance of new subscriber and subordinate CA certificates signed with SHA-1, and SC-053 (2022) ended SHA-1 for delegated OCSP signing. The ballot text notes that unexpired, unrevoked subordinate CA certificates with SHA-1 signatures still existed, and that some CRLs disclosed to the CCADB were still signed with SHA-1. SHA-1 stays allowed for the issuerNameHash and issuerKeyHash fields in OCSP requests, as RFC 5019 requires. Google's Chrome Root Program proposed it; Apple and HARICA endorsed it.

## Effective dates

The BR change took effect on 2026-02-25. The CRL ban and the revocation deadline apply from 2026-09-15; as of November 2026 both are in force.

## Who is affected

SC-097 affects CAs with old hierarchies. Website certificates were already SHA-256 or better; a revoked SHA-1 intermediate only matters if a server still sends an outdated chain containing one.

## What to do

Make sure your server sends the current chain from your CA. Inspect each certificate in the chain with the [certificate decoder](https://ssl.sh/tools/certificate-decoder/) and replace any SHA-1 signed intermediate.


| Field | Value |
|---|---|
| Ballot | SC-097 |
| Status | Passed |
| Adopted | 2026-02-24 |
| Effective | 2026-02-25 |
| BR version | 2.2.5 |
| Official page | https://cabforum.org/2026/01/24/ballot-sc097-sunset-all-remaining-use-of-sha-1-signatures-in-certificates-and-crls/ |