Mozilla has warned Firefox users that its decision to reject SHA-1 certificates has caused an unfortunate side effect: some man-in-the-middle devices, such as security scanners and antivirus products, are failing to connect to HTTPS sites.
The browser maker advised any netizens affected by the interference to install the latest version of Firefox, which reinstates support for SHA-1.
Indeed, ’tis the season for browser upgrades. As Ars reported on Tuesday, Microsoft has been furiouslynudging Internet Explorer holdouts over to the latest versions of its browser.
Mozilla banned new certificates signed with the SHA-1 digest algorithm as of January 1 this year.
Firefox fans affected by Mozilla’s decision to shun the hashing algorithm were advised to make sure that their systems—such as AV software and security scanning kit—were up-to-date, given that many vendors are now moving away from the weak SHA-1.
There is a workaround for those Firefox users who want to altogether skip reinstalling the browser: just visit
about:config and change the value of
security.pki.sha1_enforcement_level to 0 (zero). This will allow those SHA-1 certs past Mozilla’s burly bouncers.
Mozilla promised it would eventually banish SHA-1 from its browser.
“The latest version of Firefox re-enables support for SHA-1 certificates to ensure that we can get updates to users behind man-in-the-middle devices, and enable us to better evaluate how many users might be affected,” said Mozilla’s security bod Richard Barnes.
Both Microsoft and Google announced late last year that they are also looking at dropping support for security certificates that were signed with SHA-1. The underlying issue is that the cryptographic hashing power of SHA-1 just isn’t strong enough in the face of modern computer hardware, and thus it’s becoming perilously easy to create forged certs.
SOURCE: Kelly Fiveash | Ars Technica