Windows
Windows
In November, we shared a with some early details on our schedule for blocking SHA-1 signed TLS certificates. Today we would like to share some more details to share on how this will be rolled out.
Starting with the Windows 10 Anniversary Update, Microsoft Edge and Internet Explorer will no longer consider websites protected with a SHA-1 certificate as secure and will remove the address bar lock icon for these sites. These sites will continue to work, but will not be considered secure. This change will be in upcoming Windows Insider Preview builds soon, and will be deployed broadly this summer. In February 2017, both Microsoft Edge and Internet Explorer will block SHA-1 signed TLS certificates.
This update will be delivered to Microsoft Edge on Windows 10 and Internet Explorer 11 on Windows 7, Windows 8.1 and Windows 10, and will only impact certificates that chain to a CA in the Microsoft Trusted Root Certificate program. Both Microsoft Edge and Internet Explorer 11 will provide additional details in the F12 Developer Tools console to assist site administrators and developers.
Additional information on Microsoft’s overall SHA-1 deprecation plans can be found .
Test blocking of SHA-1 TLS Certificates
You can enable logging your use of SHA1 certificates by typing the following commands into an Administrator Command Prompt. The following command does not block the use of SHA1 TLS certificates; however, it will log the certificate to the provided directory.
First Create a logging directory and grant universal access:
Enable certificate logging
Use the following command to remove the settings after you have completed your testing.
Additional information on these commands and other protections against weak crypto can be found here: .
– Alec Oot, Senior Program Manager
– Mike Stephens, Senior Program Manager
Starting with the Windows 10 Anniversary Update, Microsoft Edge and Internet Explorer will no longer consider websites protected with a SHA-1 certificate as secure and will remove the address bar lock icon for these sites. These sites will continue to work, but will not be considered secure. This change will be in upcoming Windows Insider Preview builds soon, and will be deployed broadly this summer. In February 2017, both Microsoft Edge and Internet Explorer will block SHA-1 signed TLS certificates.
This update will be delivered to Microsoft Edge on Windows 10 and Internet Explorer 11 on Windows 7, Windows 8.1 and Windows 10, and will only impact certificates that chain to a CA in the Microsoft Trusted Root Certificate program. Both Microsoft Edge and Internet Explorer 11 will provide additional details in the F12 Developer Tools console to assist site administrators and developers.
Additional information on Microsoft’s overall SHA-1 deprecation plans can be found .
Test blocking of SHA-1 TLS Certificates
You can enable logging your use of SHA1 certificates by typing the following commands into an Administrator Command Prompt. The following command does not block the use of SHA1 TLS certificates; however, it will log the certificate to the provided directory.
First Create a logging directory and grant universal access:
set LogDir=C:Log
mkdir %LogDir%
icacls %LogDir% /grant *S-1-15-2-1
OI)(CI)(F)
icacls %LogDir% /grant *S-1-1-0OI)(CI)(F)
icacls %LogDir% /grant *S-1-5-12OI)(CI)(F)
icacls %LogDir% /setintegritylevel L
mkdir %LogDir%
icacls %LogDir% /grant *S-1-15-2-1
OI)(CI)(F) icacls %LogDir% /grant *S-1-1-0
OI)(CI)(F)icacls %LogDir% /grant *S-1-5-12
OI)(CI)(F)icacls %LogDir% /setintegritylevel L
Enable certificate logging
Certutil -setreg chainWeakSignatureLogDir %LogDir%
Certutil -setreg chainWeakSha1ThirdPartyFlags 0x80900008
Certutil -setreg chainWeakSha1ThirdPartyFlags 0x80900008
Use the following command to remove the settings after you have completed your testing.
Certutil -delreg chainWeakSha1ThirdPartyFlags
Certutil -delreg chainWeakSignatureLogDir
Additional information on these commands and other protections against weak crypto can be found here: .
– Alec Oot, Senior Program Manager
– Mike Stephens, Senior Program Manager