Check the signature algorithm on your site's certificate. If it says SHA-1 and the certificate runs into 2017, ask for a reissue with SHA-256 now, before browsers stop trusting it.

What changed on January 1

Since New Year's Day, certificate authorities, the companies that issue the security certificates behind https and the padlock, may no longer issue certificates signed with SHA-1.

SHA-1 is an older method of producing the digital signature that lets a browser check a certificate is genuine. It has been considered weak for years, and the SHA-2 family, usually written SHA-256, has replaced it.

Certificates already issued with SHA-1 still work today. Browser makers plan to stop trusting the remaining ones around the start of 2017, and a site still using one then will show visitors a warning instead of its pages.

Most small business sites have nothing to do. Some have a certificate bought a couple of years ago that needs replacing well before then.

What the signature is for

A certificate does two jobs. It lets the browser encrypt the connection, and it proves the site really belongs to the domain in the address bar.

The proof rests on the signature. If the method behind it becomes weak enough, someone could in principle forge a certificate that browsers would accept, and the padlock would mean nothing.

Retiring SHA-1 before that becomes practical is the point of the deadline. Some browsers already show a less reassuring symbol in the address bar for SHA-1 certificates that run past the end of this year.

Where SHA-1 is likely to linger

The first is the likeliest problem. A certificate bought for several years at once in 2014 may well carry a SHA-1 signature and stay valid into 2017, past the point where browsers plan to stop trusting it.

Checking your own certificate

Open your site in a browser, click the padlock beside the address and choose to view the certificate. In the details, find the signature algorithm.

The wording varies by browser. Anything mentioning SHA-1 or sha1 is the old method; anything mentioning SHA-256 or sha256 is the current one, and that certificate needs nothing.

Note the expiry date while you are there. A SHA-1 certificate that expires before the end of this year will be replaced at renewal anyway, since new ones can no longer use it.

Free online certificate checkers show the same information for the whole chain at once, intermediates included, which is quicker than clicking through each one.

Why long certificates are the risk

Multi-year certificates were sold as a convenience: one purchase, and no renewal to forget for three years.

The catch is that a certificate carries the standards of the day it was issued for its whole term. One bought in 2014 brings 2014's choices into 2017.

A certificate renewed every year picks up changes like this one without anybody having to think about them. That is worth weighing the next time a three-year option is offered.

A worked example

A harbour ferry service runs two small passenger boats between a waterfront village and the town across the harbour, with extra sailings in summer and charters for weddings and groups.

Tickets and charter deposits are sold through a secure booking page on its own subdomain, set up by a developer in the spring of 2014 with a three-year certificate so nobody would have to renew it.

In December, while renewing the domain, the developer checked the booking page. The certificate was signed with SHA-1 and valid until the spring of 2017.

One browser was already showing a weaker symbol beside the address. Nobody at the ferry had noticed, because the ticket office used a different browser.

The fix was a reissue. The certificate seller replaced it with a SHA-256 version for the rest of its term without a new purchase, and the developer installed it with the current intermediate certificate.

He also found the mail server still using an old certificate of its own, which the host replaced the same week. Passengers noticed nothing, which was the point.

Getting a certificate reissued

Most certificate sellers will reissue a certificate with a SHA-256 signature for the remainder of its term. Ask before buying a new one.

A reissue needs a new certificate request generated on the server, then installation of the new certificate and the intermediate that goes with it. For whoever manages your hosting, it is usually under an hour's work.

The slow part is often finding the account the certificate was bought through. If a former developer bought it in their own name, getting access can take longer than the technical work.

After installation, check the site in several browsers and on a phone, and confirm the old certificate is no longer being served anywhere.

What visitors would see

Once browsers stop trusting SHA-1, a visitor to a site still using it would not see a slightly different padlock. They would see a full warning page saying the connection cannot be trusted.

Few people click past that, and almost nobody types card details afterwards. For a booking page or a shop, it amounts to being closed.

Replacing the certificate now, months ahead, costs the same as replacing it the week the warnings start, without the lost bookings in between.

The counter-case

A site whose certificate already uses SHA-256, or whose SHA-1 certificate expires this year, has nothing urgent to do beyond renewing on time.

A few very old computers and phones that have missed years of updates cannot check SHA-256 signatures at all. They are a small and shrinking group, and the browser deadline leaves them behind regardless.

And a site with no certificate at all is a different question, which this change does not answer. For every certificate you do have, check the signature now and reissue anything still on SHA-1.

Before the warnings start

  1. List every address that uses a certificate.
  2. Check the signature algorithm on each.
  3. Note each expiry date beside it.
  4. Find the account each certificate was bought through.
  5. Request a SHA-256 reissue for any SHA-1 certificate.
  6. Install the current intermediate with it.
  7. Test in several browsers and on a phone.

Step four is the one that takes longest, so start it first. The reissue itself is quick once someone can log in to the account that holds the certificate.

Checking for quiet failures like this one belongs to the same January routine as the enquiries your business lost last year.

Frequently asked questions

What changed on January 1?

Certificate authorities may no longer issue certificates signed with SHA-1. Existing ones keep working for now, but browser makers plan to stop trusting them around the start of 2017.

How do I check my certificate?

Click the padlock, view the certificate, and find the signature algorithm in the details. Anything mentioning sha1 is the old method; sha256 is the current one.

Which certificates are most likely affected?

Ones bought for two or three years at a time in 2013 or 2014 that stay valid into 2017, plus older intermediate certificates the server sends alongside yours.

Do I need to buy a new certificate?

Usually not. Most sellers reissue a certificate with the newer signature for the rest of its term. Your host or developer generates a new request and installs it.

What will visitors see if I do nothing?

Once browsers stop trusting SHA-1, a warning page instead of your site. Few people click past it, and almost nobody enters payment details afterwards.

Does a certificate expiring this year matter?

Less. It will be replaced at renewal, and new certificates can no longer use SHA-1. Just make sure the renewal is installed with a current intermediate certificate.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Certificate bought for three years in 2014?

List the web addresses you use and send them over. We will check every certificate's signature and arrange any reissue.

Start a Conversation