Showing SHA1 certificate error in webconsole

[innovif...@gmail.com]

Hi everyone,


https://wiki.mozilla.org/CA:Problematic_Practices#SHA-1_Certificates


Mozilla had add a security warning to the Web Console "This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1."

But i had verified a lot that site is using SHA2 only.

Here is link : https://staging.landbay.co.uk/

Thanks

[Daniel Roesler]

It looks like your GeoTrust root cert uses SHA1:

GeoTrust Primary Certification Authority Self-signed
Fingerprint: 323c118e1bf7b8b65254e2e2100dd6029037f096
RSA 2048 bits (e 65537) / SHA1withRSA
Weak or insecure signature, but no impact on root certificate

See more details here:
https://www.ssllabs.com/ssltest/analyze.html?d=staging.landbay.co.uk

-Daniel

On Tue, Mar 31, 2015 at 9:28 AM,
<dev-security-...@lists.mozilla.org> wrote:
> Message: 5
> Date: Mon, 30 Mar 2015 05:24:33 -0700 (PDT)
> From: Innovify Agile <innovif...@gmail.com>
> To: mozilla-dev-s...@lists.mozilla.org
> Subject: SHA1 warning in mozilla firebug console
> Message-ID: <e38cacc8-2b15-46b4...@googlegroups.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Hello everyone,
>
> I had updated my SSL certificate sha1 to sha2 and when i do online vertification on my site it's working fine.
>
> But when i'm using mozilla firefox , firebug says "This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1."
>
> Can anyone help me to resolve this.
>
> Thanks
>

[Erwann Abalea]

Bonjour,

I haven't checked FF's code, but your websites loads elements from external websites that use SHA1-signed certificates (fonts.googleapis.com and maps.google.com). If the security warning code has no trigger based on end validity date of the certificate, that may be the reason.