Skip to content
This repository has been archived by the owner before Nov 9, 2022. It is now read-only.


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Note: This project, and much of its documentation, was written in the fall of 2014, when SHA-1 was still very common and the transition was only beginning.

As of 2016, all CAs are required to only issue SHA-2, and SHA-1 was mostly removed from modern OSes and browsers in 2017.

This web service has been retired, but the code may still be useful for other purposes.

What this repo is

This repository contains the code for, a tool which was used to check whether your site's certificate is signed using SHA-1 or SHA-2.

SHA-1 is largely gone now, and so this tool is retired. You can read more about why I originally built this tool and why replacing SHA-1 was important.

This tool does not validate certificates, or test anything besides SHA-1 vs SHA-2. For that, please visit the magnificent SSL Labs for a far more comprehensive review of your SSL configuration.

No Longer depends on openssl to download certificates. See below for a command line version.

How do I update to SHA-2?

Now that it's 2016: just get a new certificate. As of January 1 2016, all publicly trusted CAs are required to issue only SHA-2 certificates.

To update your intermediate, check what your CA is currently offering as the default, or go through the issuance process again to see what they provide you.

If you somehow get a SHA-1 certificate, or are given a SHA-1 intermediate, open an issue and the folks on this repo will be happy to badger the CA or figure out what's going on.

How can I help?

Check out the issue tracker. The biggest things are:

Really, just making the site better all around.

Running the current website

The website at is now a static site, using a frozen snapshot of the HTML in the snapshot/ directory. So if you want to reproduce that, for some reason, just point a web server at the static files in that directory.

Running the old website

The dynamic version of the app requires Node. Then, install dependencies:

npm install

And run the app:

node app.js

For best results, make sure your system is using the latest version of openssl.

To run the tests:

npm test

Tests use faucet, which should have been installed during npm install above.

Command line version

To check a domain's certificate on the command line, use this repository's command line tool:


This will exit with code 0, and output formatted JSON to STDOUT:

  "domain": "",
  "cert": {
    "algorithm": "sha1",
    "raw": "sha1WithRSAEncryption",
    "good": false,
    "root": false,
    "expires": "2017-01-05T12:00:00.000Z",
    "name": "*"
  "intermediates": [
      "algorithm": "sha1",
      "raw": "sha1WithRSAEncryption",
      "good": false,
      "root": false,
      "replacement": "",
      "expires": "2023-03-08T12:00:00.000Z",
      "name": "DigiCert Secure Server CA"
  "diagnosis": "bad"

If there's an error, you'll get some JSON with an error flag of true, and the process will exit with code 1:

$ ./bin/shaaaaaaaaaaaaa bad-domain
  "error": true,
  "domain": "bad-domain",
  "message": "Couldn't lookup hostname."


This is a tiny tool by Eric Mill. Released under an MIT License.


Check if a website has weak SHA-1 TLS certificates.







No releases published


No packages published