Discussion Period Begins - Ballot SC-097: "Sunset all remaining use of SHA-1 signatures in Certificates and CRLs"
Ryan Dickson
Purpose of Ballot SC-097:
This ballot proposes updates to the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (TLS BRs) to sunset all remaining use of SHA-1 signatures.
Background: Over the years, various sunsets have limited the use of SHA-1 within the TLS BRs, including:
Ballot 118 (2014), which prevented the issuance of any new Subscriber certificates or Subordinate CA certificates using the SHA-1 signing algorithm.
SC-053 (2022), which prevented delegated OCSP signing using the SHA-1 signing algorithm.
Despite these sunsets, unexpired and unrevoked Subordinate CA certificates containing the SHA-1 signature algorithm still exist (examples). Additionally, Certificate Revocation List (CRL) Distribution Points disclosed to the CCADB are serving CRLs signed with SHA-1 (examples).
This ballot is motivated by discussion during the Server Certificate Working Group Meeting at Face-to-Face 66 (slide 11).
Scope: Update Section 7.1.3.2.1 to prohibit all remaining use of the SHA-1 signature algorithm from appearing in Certificates or status information responses. As part of this sunset and to promote cyber hygiene, all unexpired Subordinate CA certificates containing the SHA-1 signature algorithm must be revoked.
This proposal does not prohibit the use of SHA-1 to generate issuerKeyHash or issuerNameHash values, as currently required by RFC 5019.
Justification: This ballot complements prior efforts within the CA/Browser Forum to eliminate use of the SHA-1 signature algorithm from PKI hierarchies adhering to the TLS BRs.
Weaknesses regarding the use of the SHA-1 signature algorithm have been known for several years. These weaknesses were first demonstrated in 2017.
Benefits of adoption:
Promote cyber hygiene.
Reduce risk of potential collisions due to the inherent weaknesses of SHA-1, therefore improving security.
Promote use of modern PKI hierarchies.
Continuity with other technologies also looking to sunset use of SHA-1 (example).
Proposed Key Dates:
Effective September 15, 2026:
Prevent use of SHA-1 in new CRLs
CAs must revoke unexpired Subordinate CA Certificates containing the SHA-1 signature algorithm.
Proposal Revision History:
Version #1 (created against TLS BR Version 2.1.9)
Version #2 (this version, created against TLS BR Version 2.2.1)
The following motion has been proposed by Ryan Dickson and Chris Clements of Google (Chrome Root Program) and endorsed by Clint Wilson (Apple) and Dimitris Zacharopoulos (HARICA).
— Motion Begins —
This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates” (“Baseline Requirements”), based on Version 2.2.1.
MODIFY the Baseline Requirements as specified in the following Redline:
— Motion Ends —
This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:
Discussion (no less than 7 days)
Start: 2026-01-09 11:30:00 ET
End no earlier than: 2026-01-16 11:30:00 ET
Vote for approval (7 days)
Start: TBD
End: TBD