Site uses SHA-2 but Chrome still warns about weak SHA-1

Question

I have multiple sites secured with SSL. All is from the same provider. At one domain Chrome says:

This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private.

I tested the domain with ssllabs.com and I got an A. Also tested with shaaaaaaaaaaaaa.com and it says, my domain has a verifiable certificate chain signed with SHA-2.

Here are my SSL settings in Apache2:

SSLEngine on
SSLProtocol all -SSLv3 -SSLv2
SSLHonorCipherOrder On
SSLInsecureRenegotiation off
SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
SSLCertificateFile /etc/ssl/certs/xxxcert.cert
SSLCertificateKeyFile /etc/ssl/private/xxxkey.key
SSLCertificateChainFile /etc/ssl/certs/sub.class1.server.ca.pem

I haven't got any errors in my error.log. Can somebody help me, where should I continue the debugging?

Verify with different browsers. See also https://sslmate.com/blog/post/chrome_cached_sha1_chains. — Steffen Ullrich, Jun 01 '15 at 14:53
Thank you! This link helped! I fixed it but i haven't enough rep to mark this as answer. — Tamas Toth, Jun 01 '15 at 15:33

score 2 · Accepted Answer · answered Oct 01 '15 at 10:12

The problem is likely that a certificate upwards in the chain is using SHA1, whereas your own one is using SHA2. My advice is to see if you can find an updated version of your chain file which uses SHA2.

Given that Google announced this in September 2014, you would think any reputable certificate authority would be supplying secure chain files by now.

You can find more information on this particular issue here: Why Chrome Thinks your SHA-2 Certificate Chain is "Affirmatively Insecure"

More information on why Google are sunsetting SHA1 is available here: Why Google is Hurrying the Web to Kill SHA-1.

Site uses SHA-2 but Chrome still warns about weak SHA-1

1 Answers1