<html>#2249: New TLS certificate for einsteintoolkit.org is self-signed and gives browser warnings/errors
<table style='border-spacing: 1ex 0pt; '>
<tr><td style='text-align:right'> Reporter:</td><td>Ian Hinder</td></tr>
<tr><td style='text-align:right'> Status:</td><td>resolved</td></tr>
<tr><td style='text-align:right'>Milestone:</td><td></td></tr>
<tr><td style='text-align:right'> Version:</td><td></td></tr>
<tr><td style='text-align:right'> Type:</td><td>bug</td></tr>
<tr><td style='text-align:right'> Priority:</td><td>critical</td></tr>
<tr><td style='text-align:right'>Component:</td><td>EinsteinToolkit website</td></tr>
</table>
<p>Comment (by Ian Hinder):</p>
<p>Thanks! The direct parent certificate, AddTrust External CA Root, seems to be using a SHA1 cert, known to be weak since 2012, as reported by ssl-checker. I suppose this is probably beyond our control, but it’s a bit disappointing not to get “full marks”! Apparently there are lots of questions and confusion on the net about intermediate certs being flagged, and how in some cases, it’s ok for some of the certs (maybe only the root?) to use SHA1. Safari, at least, is perfectly happy with it.</p>
<blockquote>
<p>One of the certificates is signed with a SHA1 signature. We recommend that you reissue or replace this certificate with one that uses a SHA-2 signature. Contact your SSL provider about how to do this. Read more about the SHA-1 deprecation here.</p>
</blockquote>
<p>--<br/>
Ticket URL: <a href='https://bitbucket.org/einsteintoolkit/tickets/issues/2249/new-tls-certificate-for-einsteintoolkitorg'>https://bitbucket.org/einsteintoolkit/tickets/issues/2249/new-tls-certificate-for-einsteintoolkitorg</a></p>
</html>