p1mrx is correct - creating plain SHA-1 collisions shouldn't break the CA system. Even though it's believed that one can create an identical-prefix collision w

p1mrx is correct - creating plain SHA-1 collisions shouldn't break the CA system. Even though it's believed that one can create an identical-prefix collision with that amount of work, after the MD5 Industries demo all CAs now inject at least 64 bits of randomness into the signed certificate. Thus the certificate that they actually sign isn't predictable and doesn't have an identical prefix. Technically what one needs to break is the target-collision-resistance of SHA-1, and that's standing up much better. For things like git, however, an identical-prefix SHA-1 collision would be a problem.