As of February 2017, all the biggest internet browsers will mark all sites using SHA-1 certificates as insecure. That wouldn't be too big of a deal if more than a third of the entire world's websites (35 per cent) still rely on these things. The warning has come from Venafi Labs, which also reminds everyone that as of 'early 2017', Microsoft, Google and Mozilla will no longer trust sites with SHA-1 certificates. Venafi Labs says this can have dire consequences for businesses that don't adapt.
Some sites may get completely blocked, and others will no longer have the green padlock icon in the browser. The green palock is extremely important as it is an indication for visitors if the site's traffic is private and secure. Without it, visitors might decide to look for an alternative site. Venafi Labs says businesses should expect more calls to the help desk, less revenue and even reputational damage.
Walter Goulet, cloud solutions product manager at Venafi, commented: “The results of our analysis clearly show that while the most popular websites have done a good job of migrating away from SHA-1 certificates, a significant portion of the Internet continues to rely on SHA-1 certificates. According to Netcraft’s September 2016 Web Server Survey, there are over 173 million active websites. Extrapolating from our results, as many as 61 million websites may be using such certificates.”
The company's results are based on a research of more than 11 million publically visible IPv4 websites using Venafi TrustNet.
Image source: Shutterstock/Toria