Microsoft to use SHA-2 exclusively starting May 9, 2021

Published 04-14-2021 10:02 AM 18.1K Views
Microsoft

As a major move to the more secure SHA-2 algorithm, Microsoft will allow the Secure Hash Algorithm 1 (SHA-1) Trusted Root Certificate Authority to expire. Beginning May 9, 2021 at 4:00 PM Pacific Time, all major Microsoft processes and services—including TLS certificates, code signing and file hashing—will use the SHA-2 algorithm exclusively.

Why are we making this change?

The SHA-1 hash algorithm has become less secure over time because of the weaknesses found in the algorithm, increased processor performance, and the advent of cloud computing. Stronger alternatives such as the Secure Hash Algorithm 2 (SHA-2) are now strongly preferred as they do not experience the same issues. As a result, we changed the signing of Windows updates to use the more secure SHA-2 algorithm exclusively in 2019 and subsequently retired all Windows-signed SHA-1 content from the Microsoft Download Center on August 3, 2020.

What does this change mean?

The Microsoft SHA-1 Trusted Root Certificate Authority expiration will impact SHA-1 certificates chained to the Microsoft SHA-1 Trusted Root Certificate Authority only. Manually installed enterprise or self-signed SHA-1 certificates will not be impacted; however we strongly encourage your organization to move to SHA-2 if you have not done so already.

Keeping you protected and productive

We expect the SHA-1 certificate expiration to be uneventful. All major applications and services have been tested, and we have conducted a broad analysis of potential issues and mitigations. If you do encounter an issue after the SHA-1 retirement, please see Issues you might encounter when SHA-1 Trusted Root Certificate Authority expires. In addition, Microsoft Customer Service & Support teams are standing by and ready to support you. 

 

5 Comments
Contributor

Another XP killer i guess

New Contributor

Hello @Rommel_Degracia  thanks for the share. 

Frequent Visitor

Hi, 

Thanks for sharing.

Keep up the good work.

R.

Occasional Visitor

Windows Hyper-V Virtual Machine Connection is still use SHA1, from Windows Server 2008 to Windows 10 20h2.

Occasional Visitor

Will this break early versions of Windows?

%3CLINGO-SUB%20id%3D%22lingo-sub-2261924%22%20slang%3D%22en-US%22%3EMicrosoft%20to%20use%20SHA-2%20exclusively%20starting%20May%209%2C%202021%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2261924%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20a%20major%20move%20to%20the%20more%20secure%20SHA-2%20algorithm%2C%20Microsoft%20will%20allow%20the%20Secure%20Hash%20Algorithm%201%20(SHA-1)%20Trusted%20Root%20Certificate%20Authority%20to%20expire.%20Beginning%20May%209%2C%202021%20at%204%3A00%20PM%20Pacific%20Time%2C%20all%20major%20Microsoft%20processes%20and%20services%E2%80%94including%20TLS%20certificates%2C%20code%20signing%20and%20file%20hashing%E2%80%94will%20use%20the%20SHA-2%20algorithm%20exclusively.%3C%2FP%3E%0A%3CH2%20style%3D%22margin-top%3A%2036px%3B%20margin-bottom%3A%2020px%3B%20font-family%3A%20'Segoe%20UI'%2C%20Segoe%2C%20Tahoma%2C%20Geneva%2C%20sans-serif%3B%20font-weight%3A%20600%3B%20font-size%3A%2020px%3B%20color%3A%20%23333333%3B%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493800457%22%20id%3D%22toc-hId--493682432%22%3EWhy%20are%20we%20making%20this%20change%3F%3C%2FH2%3E%0A%3CP%20style%3D%22margin-top%3A%2020px%3B%22%3EThe%20SHA-1%20hash%20algorithm%20has%20become%20less%20secure%20over%20time%20because%20of%20the%20weaknesses%20found%20in%20the%20algorithm%2C%20increased%20processor%20performance%2C%20and%20the%20advent%20of%20cloud%20computing.%20Stronger%20alternatives%20such%20as%20the%20Secure%20Hash%20Algorithm%202%20(SHA-2)%20are%20now%20strongly%20preferred%20as%20they%20do%20not%20experience%20the%20same%20issues.%20As%20a%20result%2C%20we%20changed%20the%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Ftopic%2F2019-sha-2-code-signing-support-requirement-for-windows-and-wsus-64d1c82d-31ee-c273-3930-69a4cde8e64f%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Esigning%20of%20Windows%20updates%3C%2FA%3E%20to%20use%20the%20more%20secure%20SHA-2%20algorithm%20exclusively%20in%202019%20and%20subsequently%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-it-pro-blog%2Fsha-1-windows-content-to-be-retired-august-3-2020%2Fba-p%2F1544373%22%20target%3D%22_blank%22%3Eretired%20all%20Windows-signed%20SHA-1%20content%3C%2FA%3E%20from%20the%20Microsoft%20Download%20Center%20on%20August%203%2C%202020.%3C%2FP%3E%0A%3CH2%20style%3D%22margin-top%3A%2036px%3B%20margin-bottom%3A%2020px%3B%20font-family%3A%20'Segoe%20UI'%2C%20Segoe%2C%20Tahoma%2C%20Geneva%2C%20sans-serif%3B%20font-weight%3A%20600%3B%20font-size%3A%2020px%3B%20color%3A%20%23333333%3B%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993712376%22%20id%3D%22toc-hId-1993830401%22%3EWhat%20does%20this%20change%20mean%3F%3C%2FH2%3E%0A%3CP%20style%3D%22margin-top%3A%2020px%3B%22%3EThe%20Microsoft%20SHA-1%20Trusted%20Root%20Certificate%20Authority%20expiration%20will%20impact%20SHA-1%20certificates%20chained%20to%20the%20Microsoft%20SHA-1%20Trusted%20Root%20Certificate%20Authority%20only.%20Manually%20installed%20enterprise%20or%20self-signed%20SHA-1%20certificates%20will%20not%20be%20impacted%3B%20however%20we%20strongly%20encourage%20your%20organization%20to%20move%20to%20SHA-2%20if%20you%20have%20not%20done%20so%20already.%3C%2FP%3E%0A%3CH2%20style%3D%22margin-top%3A%2036px%3B%20margin-bottom%3A%2020px%3B%20font-family%3A%20'Segoe%20UI'%2C%20Segoe%2C%20Tahoma%2C%20Geneva%2C%20sans-serif%3B%20font-weight%3A%20600%3B%20font-size%3A%2020px%3B%20color%3A%20%23333333%3B%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186257913%22%20id%3D%22toc-hId-186375938%22%3EKeeping%20you%20protected%20and%20productive%3C%2FH2%3E%0A%3CP%20style%3D%22margin-top%3A%2020px%3B%22%3EWe%20expect%20the%20SHA-1%20certificate%20expiration%20to%20be%20uneventful.%20All%20major%20applications%20and%20services%20have%20been%20tested%2C%20and%20we%20have%20conducted%20a%20broad%20analysis%20of%20potential%20issues%20and%20mitigations.%20If%20you%20do%20encounter%20an%20issue%20after%20the%20SHA-1%20retirement%2C%20please%20see%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fhelp%2F5003341%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EIssues%20you%20might%20encounter%20when%20SHA-1%20Trusted%20Root%20Certificate%20Authority%20expires%3C%2FA%3E.%20In%20addition%2C%20Microsoft%20Customer%20Service%20%26amp%3B%20Support%20teams%20are%20standing%20by%20and%20ready%20to%20support%20you.%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin-top%3A%2020px%3B%22%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2261924%22%20slang%3D%22en-US%22%3E%3CP%3EMoving%20forward%2C%20all%20major%20Microsoft%20processes%20and%20services%20will%20use%20SHA-2.%20Learn%20more.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22dev-it.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F272860iB6E449F5127B764A%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22dev-it.png%22%20alt%3D%22dev-it.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2261924%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EServicing%20and%20updates%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2273610%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20to%20use%20SHA-2%20exclusively%20starting%20May%209%2C%202021%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2273610%22%20slang%3D%22en-US%22%3E%3CP%3EAnother%20XP%20killer%20i%20guess%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2274876%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20to%20use%20SHA-2%20exclusively%20starting%20May%209%2C%202021%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2274876%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1015830%22%20target%3D%22_blank%22%3E%40Rommel_Degracia%3C%2FA%3E%26nbsp%3B%20thanks%20for%20the%20share.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2275548%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20to%20use%20SHA-2%20exclusively%20starting%20May%209%2C%202021%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2275548%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20sharing.%3C%2FP%3E%3CP%3EKeep%20up%20the%20good%20work.%3C%2FP%3E%3CP%3ER.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2276818%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20to%20use%20SHA-2%20exclusively%20starting%20May%209%2C%202021%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2276818%22%20slang%3D%22en-US%22%3E%3CP%3EWindows%20Hyper-V%20Virtual%20Machine%20Connection%20is%20still%20use%20SHA1%2C%20from%20Windows%20Server%202008%20to%20Windows%2010%2020h2.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2337883%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20to%20use%20SHA-2%20exclusively%20starting%20May%209%2C%202021%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2337883%22%20slang%3D%22en-US%22%3E%3CP%3EWill%20this%20break%20early%20versions%20of%20Windows%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Co-Authors
Version history
Last update:
‎Apr 14 2021 10:03 AM
Updated by: