Will JotForm be using security certificate with SHA2 and RSA2

  • UnLitho
    Asked on December 18, 2014 at 7:09 PM

    The following is conveniently copied for its examples from here.

    chrome compact floating addressbar Screenshot 10

    As of late 2014, SHA1 certificates and it’s SHA1 trust chain (not including the Root CA) will be considered insecure by Google Chrome.

    A three step process will increase the severity of the warning:

    1. Initially SHA1 certificates that expire on/after 2017/1/1, and which contain SHA-1-based signatures in the validated chain, will be shown the “Secure, but minor errors” icon.  This is a lock with a yellow triangle chrome 95440 https warning triangle Screenshot 21

    2. Severity will increase thereafter, where:
    SHA1 certificates that expire between 2016/6/1 and 2016/12/31, inclusively, and which contain SHA-1-based signatures in the validated chain, will be shown the “Secure, but minor errors” icon. This is a lock with a yellow trianglechrome 95440 https warning triangle Screenshot 21SHA1 certificates that expire on/after 2017/1/1, and which contain SHA-1-based signatures in the validated chain, will be shown the “Neutral, no security” icon. This is the blank page icon, as shown by HTTP URLs. SNP 2709331 en v0 Screenshot 43

    3. Finally Chrome will render websites with SHA1 certificates that expire on/after 2017/1/1 and which contain SHA-1-based signatures in the validated chain, with the “Affirmatively insecure, major errors” icon. The “Affirmatively insecure, major errors” icon is a lock with a red Xchrome 14679 redhttps en Screenshot 54

    To resolve this issue SHA2 certificates must be installed.

     

    ------

     

    Considering your certificate expires in the next few months, it might be convenient to go ahead and have them renew at SHA2 and get that done and over with.

  • jonathan
    Replied on December 18, 2014 at 8:22 PM

    Hi,

    Thank you for providing us the details about SHA2 certificate.

    Let me elevate your inquiry to our higher team support as they will be the one to most likely provide you with the right explanation and details.

    You will be notified on this thread for any update on the status.

    Thanks.

  • eee Chief Technology Officer
    Replied on December 19, 2014 at 3:49 AM

    Hey @Unlitho,

    Thanks for the information.

    We will migrate all our certificates to SHA2, after new year. 

    Kindest Regards,

    - Ertugrul.

  • eee Chief Technology Officer
    Replied on January 20, 2015 at 7:54 AM

    Hey again @UnLitho,

    SSL certificates are renewed with SHA256 /w RSA,

    https://www.ssllabs.com/ssltest/analyze.html?d=secure.jotform.com

    Will JotForm be using security certificate with SHA2 and RSA2  Image 1 Screenshot 20

    Kindest Regards,

    - Ertugrul.

  • UnLitho
    Replied on January 20, 2015 at 1:15 PM

    @eee Great to hear! Thanks for following up!

  • KadeJM
    Replied on January 20, 2015 at 2:47 PM

    On behalf of "eee" you are very welcome. :)