Yesterday I enabled OCSP stapling for my website in nginx.
Now when I check my website using Qualys SSL Labs I have 2 trust paths, 1 using a SHA1 root certificate and 1 using a SHA256 root certificate. I don't recall having seen this before, as I remember I had only one trust path with all SHA256 certificates.
On my Android device using Chrome, the HTTPS text in the address bar is now red, saying SHA1 signatures are being used. This is not the case on my desktop and the SSL Labs test doesn't complain about anything.
I've tried disabling OCSP stapling because ocsp.startssl.com seems to be returning a SHA1 certificate, but after clearing all browser data the HTTPS text is still red.
How can this be? I'm 100% sure my certificate and the intermediate certificate are SHA256. I'm not sending the root certificate.