Yesterday I enabled OCSP stapling for my website in nginx.

Now when I check my website using Qualys SSL Labs I have 2 trust paths, 1 using a SHA1 root certificate and 1 using a SHA256 root certificate. I don't recall having seen this before, as I remember I had only one trust path with all SHA256 certificates.

On my Android device using Chrome, the HTTPS text in the address bar is now red, saying SHA1 signatures are being used. This is not the case on my desktop and the SSL Labs test doesn't complain about anything.

I've tried disabling OCSP stapling because ocsp.startssl.com seems to be returning a SHA1 certificate, but after clearing all browser data the HTTPS text is still red.

How can this be? I'm 100% sure my certificate and the intermediate certificate are SHA256. I'm not sending the root certificate.

  • maybe you have wrong date on Android device?
    – emirjonb
    Jul 24 '15 at 12:45
  • No, it's saying the certificate is using a weak signature. The date is correct. But thanks! Jul 24 '15 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.