Microsoft Edge and Internet Explorer will block SHA-1 signed TLS certificates in 2017

John White By: John White
2 minute read

Home » Microsoft Edge and Internet Explorer will block SHA-1 signed TLS certificates in 2017

We’ve long known that Microsoft was planning on blocking SHA-1 signed TLS certificates but recently, the company shared more details on the matter. Apparently, both Microsoft Edge and Internet explorer will both block SHA-1 signed TLS certificates beginning on February of 2017.

When the Anniversary Update rolls out, Microsoft Edge and Internet Explorer will no longer consider web pages protected with SHA-1 as secure. The lock icon in the address bar will be removed to indicate this, so any website with SHA-1 signed TLS will have to make some important changes before Microsoft rolls out this new update.

This update will be delivered to Microsoft Edge on Windows 10 and Internet Explorer 11 on Windows 7, Windows 8.1 and Windows 10, and will only impact certificates that chain to a CA in the Microsoft Trusted Root Certificate program. Both Microsoft Edge and Internet Explorer 11 will provide additional details in the F12 Developer Tools console to assist site administrators and developers, according to Microsoft.

Developers will want to know how to test block their SHA-1 signed TLS certificates. The following information will log your SHA1 certificates, so don’t expect your certificates to be blocked.

First Create a logging directory and grant universal access:

set LogDir=C:\Log
mkdir %LogDir%
icacls %LogDir% /grant *S-1-15-2-1:(OI)(CI)(F) 
icacls %LogDir% /grant *S-1-1-0:(OI)(CI)(F)
icacls %LogDir% /grant *S-1-5-12:(OI)(CI)(F)
icacls %LogDir% /setintegritylevel L

Enable certificate logging

Certutil -setreg chain\WeakSignatureLogDir %LogDir%
Certutil -setreg chain\WeakSha1ThirdPartyFlags 0x80900008

Use the following command to remove the settings after you have completed your testing.

Certutil -delreg chain\WeakSha1ThirdPartyFlags
Certutil -delreg chain\WeakSignatureLogDir

Microsoft has an entire web page explaining the need for this move among other things aimed at the developer crowd.

RELATED STORIES YOU NEED TO CHECK OUT:

Discussions

Next up

Top 9 tools to create stunning digital ads for your marketing campaign

Tashreef Shareef avatar. By: Tashreef Shareef
2 minute read

“A picture is worth a thousand words” is a popular English idiom and the quote perfectly describes digital marketing or marketing strategies in general that […]

Continue Reading

5 Christmas sweaters with lights and music for your loved ones

Madhuparna Sukul avatar. By: Madhuparna Sukul
Less than a 1 minute read

While the winter arrives with the joy of Christmas, it also brings the freezing weather along. Of course, there’s the fireplace to warm you up, […]

Continue Reading

Users claim Microsoft still collects activity history despite being disabled

Giles Ensor avatar. By: Giles Ensor
3 minute read

Recent comments on Reddit would suggest that Microsoft is still not playing the game when it comes to collecting data on its users. This is […]

Continue Reading