SHA-1 in HTTPS on GitHub sunset
GitHub has officially disabled support for the SHA-1 cryptographic hash algorithm within HTTPS connections for github.com and partner services. This change enforces the use of more secure hashing algorithms for all incoming web traffic.
Verified State Diff
Impact & Verification Analysis
Developers using legacy clients, outdated operating systems, or older libraries that do not support modern TLS cipher suites.
It eliminates a significant cryptographic vulnerability, preventing potential man-in-the-middle attacks that rely on SHA-1 collision weaknesses to spoof certificates.
Full Fact Overview
The deprecation of SHA-1 in HTTPS is a critical security hardening measure, as SHA-1 is cryptographically broken and vulnerable to collision attacks. By disabling this legacy algorithm, GitHub ensures that all TLS/SSL handshakes must utilize stronger alternatives such as SHA-256 or higher. This aligns with industry-wide security standards mandated by major browser vendors and regulatory bodies to protect data integrity and authenticity during transit.