5 ms·
It's a problem for intermediates, yes. You'd have to request a re-issue by an intermediate which itself is certified using something better than sha-1. It's n
by pilif 12y ago
It's a problem for intermediates, yes.
You'd have to request a re-issue by an intermediate which itself is certified using something better than sha-1.
It's not, however a problem for the roots because those are checked by browser using the actual private key they know by virtue of the root actually be embedded in the browser/os itself instead of just checking the SHA-1 signature.
- eatler 12y agoActually, the root certificate itself simply does not need to be checked at all, as we need to trust it anyway. In the last verification step, we verify that the last intermediate certificate in the chain has a valid signature from the root CA certificate, by using the public (!) key of the root CA certificate stored in the browser.