Google will drop SHA-1 encryption from Chrome by January 1, 2017

Back in September 2014, Google outlined its plans to drop support for the SHA-1 cryptographic hash algorithm in Chrome. The schedule has moved around a bit since, and now the company is committing to ditching the outdated encryption technology by January 1, 2017.

Browsers and websites encrypt traffic to protect the contents of online communications using a hash function. A unique fingerprint is created for each chunk of data and is digitally signed to prove that a message has not been altered or tampered with when it passes through various servers. When the Certificate Authority and Browser Forum published their Baseline Requirements for SSL in 2011, SHA-1 was essentially deprecated. They identified security weaknesses in SHA-1 and recommended that all certificate authorities (CAs) transition away from SHA-1 based signatures, with a full sunset date of January 1, 2016.

Currently, Chrome does not treat SHA-1 certificates as secure, and the plan is to completely stop supporting them over the next year. This will happen in two steps:

1. Chrome 48, which is currently in beta and slated for release by the end of January 2016, will display a certificate error if it encounters a site with a leaf certificate that is signed with a SHA-1-based signature, is issued on or after January 1, 2016, and chains to a public CA. A later version of Chrome in 2016 may extend the criteria, but Google hasn’t decided that for certain yet. Because public CAs must stop issuing SHA-1 certificates in 2016, Google is hoping “that no one will encounter this error.”



2. Chrome will completely stop supporting SHA-1 certificates by January 1, 2017. Sites that have a SHA-1-based signature as part of the certificate chain (not including the self-signature on the root certificate, but including certificate chains that end in a local trust anchor and those that end at a public CA), will trigger a fatal network error. Both Microsoft Edge and Mozilla Firefox are also targeting January 1, 2017, though Google says it may “considering moving it earlier to July 1, 2016.”

So the date is still a moving target, but Google is hoping that definitely by 2017, Chrome will no longer support SHA-1. Because Chrome tries to use the certificate trust settings of the operating system it is installed on, users may actually see a fatal network error in the browser even sooner, assuming they install the latest security update.

In short, if your site still depends on a SHA-1 certificate, you should replace it as soon as possible. Instead, your servers should use SHA-2 certificates, support non-RC4 cipher suites, and follow TLS best practices. Google specifically recommends supporting TLS 1.2 and prioritizing the ECDHE_RSA_WITH_AES_128_GCM cipher suite.