Hacker News new | past | comments | ask | show | jobs | submit login

Just to clarify: the other replies are correct. The logic is that if the leaf certificate has an expiry after Dec 31st, 2015 then the whole chain must be SHA-256. If the leaf expires before that, then other certificates in the chain don't matter.

If you have a one year certificate (and I always recommend getting one year certificates so that these issues don't affect you and so that renewal becomes an annual chore, not an irregular panic) then you don't have to worry.

StartSSL simply need to cut new intermediates, signed with SHA-256, and provide them to customers once the leaf certificates that they issue start to stretch into 2016.




Why can't you just verify that the whole chain is SHA-1 instead of using the expiration date as a heuristic?


Because then everything will seem fine until 2017 at which point all the sites break at once. Using the expiration date makes it gradual and shows problems when certificate updates are tested.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: