SHA-1 (Secure Hash Algorithm 1)

SHA-1 is a hash function designed by the NSA and published by NIST in FIPS 180-1 in 1995, producing a 160-bit digest. Theoretical weaknesses were published in 2005. In February 2017, researchers from Google and CWI Amsterdam announced SHAttered, the first public SHA-1 collision: two different PDF files with the same digest. In 2020 a chosen-prefix collision followed, the kind of attack that makes forging signed objects such as certificates realistic.

Why it matters

Because a certificate signature covers a hash of the certificate, a broken hash undermines the signature. The CA/Browser Forum Baseline Requirements stopped the issuance of SHA-1 signed TLS certificates from 1 January 2016, and major browsers stopped accepting SHA-1 signed TLS certificates in early 2017. Today, certificates are signed with SHA-256 or SHA-384. SHA-1 still appears in harmless places, such as fingerprints shown by tools and HMAC-SHA1 in older cipher suites.

Example

Check what hash a certificate's signature uses; sha1WithRSAEncryption on a leaf or intermediate is a red flag:

openssl x509 -in example.com.crt -noout -text | grep 'Signature Algorithm'
openssl x509 -in example.com.crt -noout -fingerprint -sha1

The second command computes a SHA-1 fingerprint locally, which says nothing about how the certificate was signed.

Common misconceptions

• "A SHA-1 fingerprint means the certificate uses SHA-1." A fingerprint is calculated by whoever views the certificate, with any hash they choose; it is unrelated to the signature algorithm.
• "Cipher suites ending in -SHA are broken because SHA-1 is broken." Those suites use HMAC-SHA1, which does not rely on collision resistance. The reasons to retire them are CBC mode and missing AEAD.
• "A root certificate self-signed with SHA-1 must be replaced." A root is trusted because it is in the trust store, not because of its self-signature; the signatures on intermediates and leaf certificates are what matter.