If you want to test out this behavior before it rolls out, you can set security.pki.sha1_enforcement_level (per Gervase Markham). A value of 1 means "entirely

If you want to test out this behavior before it rolls out, you can set security.pki.sha1_enforcement_level (per Gervase Markham). A value of 1 means "entirely forbidden", a value of 3 means "forbidden for public roots". I can't speak for the behavior when using any other value.