Click the padlock and open the certificate details: note the signature algorithm and the expiry date. If it uses SHA-1 and expires in 2016 or later, ask your seller to reissue it with SHA-256.

A padlock about to change

A records company's customers log in to request their boxes through a secure page, and Chrome shows the familiar green padlock beside the address. Nothing looks wrong, and for now nothing is.

On Friday Google said that will change for many sites. Chrome will gradually mark pages as less secure when their certificate is signed with SHA-1 and expires in 2016 or later, starting with a version due later this year.

For most small businesses with a certificate, the fix is a reissue that takes the host an hour and usually comes at no extra charge. The work is in knowing whether you need one.

What SHA-1 is and why it is going

A certificate is signed by the company that issued it, and the signature is built on a hash, a kind of digital fingerprint. For years the usual fingerprint has been SHA-1.

Researchers have shown SHA-1 to be weaker than designed, and computing power keeps getting cheaper. The concern is that forging a SHA-1 signature will become practical, and a forged certificate could impersonate a real site.

Its replacement, SHA-256, belongs to a family called SHA-2. Certificate sellers already issue it, and current browsers accept it.

Microsoft said last year that Windows will stop accepting SHA-1 certificates after 2016. Google's schedule for Chrome begins much sooner, and that is what brings the question forward.

What Chrome will show

The warnings arrive in stages across several Chrome releases, from later this year into early next year:

The pattern is simple: the later a SHA-1 certificate expires, the sooner and more strongly Chrome objects to it.

Checking which kind you have

In Chrome, a click on the padlock leads to the certificate information. Its details list a signature algorithm, which will include either sha1 or sha256, and the dates the certificate is valid.

The certificate path shows the intermediate certificate above yours. Check its algorithm too, because a SHA-256 certificate issued under a SHA-1 intermediate still draws the warning.

Your host or the company that sold the certificate can confirm all of this in a few minutes. So can the online certificate checkers that test a site from outside.

Write down what you find, with the expiry date, so that the next renewal is planned rather than a surprise.

Reissuing is usually simple

A reissue replaces the certificate with a new one for the same address and the same remaining term. Many sellers do it without charge; ask yours before assuming otherwise.

The host creates a new request on the server, the seller issues the new certificate signed with SHA-256, and the host installs it with the matching intermediate. The old certificate can then be revoked.

Nothing changes for visitors except the details behind the padlock. Links, bookmarks and the address all stay as they were.

When to do it

A certificate that expires before 2016 needs nothing now. Replace it at its normal renewal, and make sure the new one is signed with SHA-256.

One that runs into 2016 or beyond should be reissued in the coming weeks, before the first warnings reach your customers. Chrome updates itself automatically, so they will not choose when the warning appears.

Three-year certificates bought last year are the usual case. Most were issued with SHA-1 as standard, and they run well past the dates Chrome now cares about.

A worked example

A records storage company keeps boxes of business files in a warehouse near the river, and handles retrievals, deliveries and secure destruction. Customers request their boxes through a login on its website.

Last year it bought a three-year certificate for the login pages. After reading about Chrome's plans, the office manager clicked the padlock and found SHA-1 on both the certificate and its intermediate.

The expiry date fell in 2016. The host generated a new request, the seller reissued the certificate with SHA-256 for its remaining term at no charge, and the host installed it with the new intermediate the same afternoon.

The manager then logged in from Chrome, Firefox and Internet Explorer, from her phone, and from the old computer in the warehouse office, which runs Windows XP.

That computer could not open the page until its last service pack was installed, because older versions of XP cannot check SHA-256 signatures.

The change works because the certificate now carries a signature that Chrome and Windows will keep accepting, so its expiry date no longer matters for the warnings.

Older systems and SHA-256

A few very old systems cannot check SHA-256 signatures at all. Windows XP without its third service pack is the one offices are most likely to meet, along with some much older devices.

For a public site those visitors are few. For a portal used by known customers, it is worth asking whether any of them still work on such machines before the switch.

The counter-case

A certificate that expires next year is unaffected, and reissuing it now gains nothing. Let it run, and choose SHA-256 when it is renewed.

A site with no secure pages has no certificate to worry about. Whether it should have one is a separate question, and a growing one.

For everyone else the reissue is small, often free, and better done now than in a hurry after a customer asks why the padlock carries a warning.

Checking the certificate before the warnings

  1. Open a secure page of your site in Chrome.
  2. Open the certificate details from the padlock.
  3. Note the signature algorithm and the expiry date.
  4. Check the intermediate certificate the same way.
  5. Ask the seller to reissue with SHA-256 if needed.
  6. Have the host install it with the new intermediate.
  7. Test in several browsers and on older office computers.

Step four catches what a quick look misses. A new SHA-256 certificate installed with an old SHA-1 intermediate still draws the warning, and only the certificate path shows why.

For a site with no certificate yet, what moving to HTTPS involves, and why Google now gives it some weight, is set out in Google adds HTTPS as a ranking signal.

Frequently asked questions

What did Google announce about SHA-1 on Friday?

That Chrome will gradually mark secure pages as less secure when their certificate, or an intermediate in its chain, uses SHA-1 and expires in 2016 or later.

How do we see which algorithm our certificate uses?

Click the padlock in Chrome, open the certificate information and read the signature algorithm in the details. Check the intermediate certificate in the path as well.

Does a certificate expiring next year need reissuing?

No. Certificates that expire before 2016 fall outside Chrome's schedule. Choose SHA-256 when the certificate next comes up for renewal.

Does reissuing cost anything?

Many sellers reissue for the remaining term without charge. The host creates a new request and installs the new certificate and intermediate, and nothing changes for visitors.

Can every computer read SHA-256 certificates?

Nearly all can. Windows XP without its third service pack and some much older devices cannot, so a portal with known users should check before switching.

Why is SHA-1 being retired?

Weaknesses found in it, together with cheaper computing power, mean forging a SHA-1 signature may become practical. SHA-256 is the stronger replacement browsers now prefer.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure which certificate your site uses?

Tell us the address of your secure pages, and we will check the certificate chain and arrange a reissue if needed.

Start a Conversation