The hash algorithm of a root certificate does not matter, because you explicitly trust the root certificate, and it is only signed by itself. Their intermediat

The hash algorithm of a root certificate does not matter, because you explicitly trust the root certificate, and it is only signed by itself. Their intermediates and end-entity certificates should be updated, but still, the attacks PKIs are concerned about on SHA1 (a preimage attack) can only happen during issuance. However, if a second preimage attack on SHA1 were viable, all of the above would be invalid, and SHA1 would be permanently weakened for all digital signature uses.