2 ms·
Red Hat uses SHA1 certificates for their CDN [0] (that provides packages for RHEL7 and, I assume, other products). It is a "private PKI" but their (current) in
by jlgaddis 10y ago
Red Hat uses SHA1 certificates for their CDN [0] (that provides packages for RHEL7 and, I assume, other products).
It is a "private PKI" but their (current) intermediate and root certificates do not expire for a long, long time. Hopefully they'll move to a SHA256 root in the near future.
[0]: https://cdn.redhat.com/ https://cdn.redhat.com/
- iancarroll 10y agoThe hash algorithm of a root certificate does not matter, because you explicitly trust the root certificate, and it is only signed by itself. Their intermediates and end-entity certificates should be updated, but still, the attacks PKIs are concerned about on SHA1 (a preimage attack) can only happen during issuance. However, if a second preimage attack on SHA1 were viable, all of the above would be invalid, and SHA1 would be permanently weakened for all digital signature uses.