1
$\begingroup$

Here is the context. Suppose you have a corporate PKI with :

  • AC_Root (offline in safe store - SHA1 signature)
  • SubRootA ans SubrootB (offline in safe store - SHA1 signature)
  • SubSubRootC, SubSubRootD, SubSubRootE... (online in HSM - SHA1 signature)
  • End entities certificates (servers, users smart card, auto enrollment, Active directory)

What are the impacts due to SHA1 deprecation ? I know root certificate is not concerned, because self-signature is never verified (only presence in truststore), but what about the Subroot certificates ?

Editors like Google or Microsoft announced that browsers will print warnings and even fail when SHA1 will be used, and quite soon (2015/2016).

  • Is this a hot issue for mostly security reasons or for the user experience (warnings in browser, OS refusing SHA1 certificates) ?

  • Is it needed to organise a new key ceremony for creation of a new "SHA256" chain ? Even for offline chain (root and subroots) ? Re-issuing new end entities certificats with SHA256 ? Introducing a sliding period for key renewal ?

Only Root CA is locally in browser truststore. Sub and SubSub are in Intermediate Certificates section in Windows certificates store (certmgr.exe).

$\endgroup$

closed as off-topic by Maarten Bodewes, e-sushi, Gilles, rath, DrLecter Dec 1 '14 at 9:59

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    $\begingroup$ This question appears to be off-topic because it is about security, without directly involvement of crypto itself. This one is a bit tricky, the deprecation of SHA1 has obviously to do with crypto, but I think the effects and policy change are more at home on IT security $\endgroup$ – Maarten Bodewes Nov 29 '14 at 22:10
  • $\begingroup$ of which level (Root, Sub or SubSub) is the certificate that your clients have stored locally ? e.g. for HTTPS, which is the certificate that is in your clients browsers root ca store ? $\endgroup$ – lImbus Nov 30 '14 at 13:39
  • $\begingroup$ @lImbus Only Root CA is locally in browser truststore. Sub and SubSub are in Intermediate Certificates section in Windows certificates store (certmgr.exe). $\endgroup$ – crypto-learner Nov 30 '14 at 15:36
  • $\begingroup$ @crypto-learner you need to add this information to your initial question! $\endgroup$ – lImbus Nov 30 '14 at 21:39
  • $\begingroup$ Same question over at Security-SE: security.stackexchange.com/questions/73972/… $\endgroup$ – StackzOfZtuff Dec 2 '14 at 11:33