Questions about SHA-1 CSRs and validation using TLS 1.0 / 1.1 URLs

I presume the primary motivation behind this is because Golang is moving towards rejecting SHA-1 signatures (crypto/x509: reject SHA-1 signatures in Verify · Issue #41682 · golang/go · GitHub) and is also dropping support for TLS 1.0/1.1 (crypto/tls: disable client-side TLS 1.0 and TLS 1.1 · Issue #45428 · golang/go · GitHub)? So you effectively get these things when you upgrade Go.

Anyway, I think this will be helpful in the long run. Only issue may be old software that is fixed on handing out SHA-1 CSRs. You can fix an ACME client, but not clients where you have no control over CSR generation (you know, devices where you would manually upload certs). So yeah, unfortunate but hopefully for the better.

8 Likes