.jpg){kind=link}
In 2017, Microsoft deprecated SHA-1 TLS certificates along with Google and Mozilla since the legacy hashing algorithm was no longer secure. Since then, their support shifted to SHA-2 and SHA-3, which are considered to be more secure. However, Apple had been resisting the change, until now.
The tech giant has quietly deprecated TLS certificates signed with the SHA-1 algorithm in iOS 13 and macOS 10.15 Catalina. An Apple support page details the latest move, which means HTTPS traffic using TLS certificates signed with the SHA-1 won"t be supported from today.
More specifically, the new security requirements in iOS 13 and macOS 10.15 are as follows:
- TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.
- TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.
- TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.
Apple warns that all traffic to TLS servers that won"t follow the new requirements will result in app and network failures and will cause websites to not load in Safari in iOS 13 and macOS 10.15.