Microsoft Edge and Internet Explorer will block SHA-1 signed TLS certificates in 2017

We’ve long known that Microsoft was planning on blocking SHA-1 signed TLS certificates but recently, the company shared more details on the matter. Apparently, both Microsoft Edge and Internet explorer will both block SHA-1 signed TLS certificates beginning on February of 2017.

When the Anniversary Update rolls out, Microsoft Edge and Internet Explorer will no longer consider web pages protected with SHA-1 as secure. The lock icon in the address bar will be removed to indicate this, so any website with SHA-1 signed TLS will have to make some important changes before Microsoft rolls out this new update.

This update will be delivered to Microsoft Edge on Windows 10 and Internet Explorer 11 on Windows 7, Windows 8.1 and Windows 10, and will only impact certificates that chain to a CA in the Microsoft Trusted Root Certificate program. Both Microsoft Edge and Internet Explorer 11 will provide additional details in the F12 Developer Tools console to assist site administrators and developers, according to Microsoft.

Developers will want to know how to test block their SHA-1 signed TLS certificates. The following information will log your SHA1 certificates, so don’t expect your certificates to be blocked.

First Create a logging directory and grant universal access:

set LogDir=C:\Log
mkdir %LogDir%
icacls %LogDir% /grant *S-1-15-2-1:(OI)(CI)(F) 
icacls %LogDir% /grant *S-1-1-0:(OI)(CI)(F)
icacls %LogDir% /grant *S-1-5-12:(OI)(CI)(F)
icacls %LogDir% /setintegritylevel L

Enable certificate logging

Certutil -setreg chain\WeakSignatureLogDir %LogDir%
Certutil -setreg chain\WeakSha1ThirdPartyFlags 0x80900008

Use the following command to remove the settings after you have completed your testing.

Certutil -delreg chain\WeakSha1ThirdPartyFlags

Certutil -delreg chain\WeakSignatureLogDir

Microsoft has an entire web page explaining the need for this move among other things aimed at the developer crowd.

RELATED STORIES YOU NEED TO CHECK OUT:

• Windows 10 Build 14332 causes installation fails, Edge problems, and more
• Microsoft Edge now supports Google’s WebM