Good, they should accelerate it. However, I wish that Microsoft made it extremely clear in these announcements that root certificates are not subject to SHA-1

Good, they should accelerate it. However, I wish that Microsoft made it extremely clear in these announcements that root certificates are not subject to SHA-1 collision attacks. Certain people [1] have misunderstood the situation and removed trust for SHA-1 signed roots (and that project is definitely not alone). Mozilla's announcement [2] does draw a distinction, but it's quite easy to miss. CAs like Entrust are much more clear about this, since their business relies on it. It is security theater [3] to tell users that they shouldn't use a SHA-1 signed root if they want their connections to be secure. Security vulnerabilities need to be very simply and clearly communicated -- otherwise you get solutions based on preconceived notions and simplistic "X is always BAD" thinking that do more harm than good. In this instance, people have spent days debugging connectivity issues and opening tickets with service providers. And the reasoning behind the move is not based in fact -- Mozilla has NOT removed SHA1 certs from their trusted roots [4] and they have announced no timetable in which to do so. It's simply because someone heard "SHA-1 is bad" and acted accordingly. The current SHA-1 deprecation push applies only to chain and end certificates, not to roots -- removing trust for SHA-1 signed roots is not necessary to prevent these sorts of attacks and it is much too soon to take that step in any environment that talks to systems which you don't control on the public Internet. [1] http://certifiio.readthedocs.org/ http://certifiio.readthedocs.org/ [2] https://blog.mozilla.org/security/2015/10/20/continuing-to-phase-out-sha-1-certificates/ https://blog.mozilla.org/security/2015/10/20/continuing-to-p... [3] https://github.com/certifi/python-certifi/issues/26#issuecomment-147962495 https://github.com/certifi/python-certifi/issues/26#issuecom... [4] https://mozillacaprogram.secure.force.com/CA/IncludedCACertificateReport https://mozillacaprogram.secure.force.com/CA/IncludedCACerti...