Security Alert: Azure Managed SSL Certificate issue (DigiCert Global Root CA uses SHA1)

Question

Security Alert: Azure Managed SSL Certificate issue (DigiCert Global Root CA uses SHA1)

Irakli Lomidze 96

Azure Managed SSL Certificate critical issue.

DigiCert Global Root CA, uses SHA1.

08:3B:E0:56:90:42:46:B1:A1:75:6A:C9:59:91:C7:4A

PKCS #1 SHA-1 With RSA Encryption

CN = DigiCert Global Root CA OU = www.digicert.com O = DigiCert Inc C = US

Subject Key ID: 03 DE 50 35 56 D1 4C BB 66 F0 A3 E2 1B 1B C3 97 B2 3D D1 55

Authorized Key ID: 03 DE 50 35 56 D1 4C BB 66 F0 A3 E2 1B 1B C3 97 B2 3D D1 55

Please Fix it

Ankush Raj 410 Reputation points Microsoft Employee

2025-02-24T04:43:36.41+00:00

Hi @Irakli Lomidze

I assume you're facing issue with SHA-1 signature (correct me if I'm wrong)

To help me understand better, could you please expand on the issue you're facing in detail and what do you aim to achieve?

Thanks.
Irakli Lomidze 96 Reputation points

2025-02-24T11:13:30.94+00:00

That is exactly the issue I'm referring to.

Unfortunately, I don't know how I can open the case for that security issue.

Every Managed SSL Certificate by Microsoft are signed that root certificate
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-03-03T06:02:01.67+00:00
Hello Irakli Lomidze,

I understand your concern. Azure Managed SSL Certificates are signed by the DigiCert Global Root CA, which still references SHA-1. However, Microsoft has transitioned all TLS/SSL encryption to SHA-2 and higher for security.

While the root certificate still has a SHA-1 signature, it does not affect the encryption strength of SSL/TLS connections. The actual certificates used for securing traffic (subordinate and end-entity certificates) are signed with stronger algorithms like SHA-256, SHA-384, or SHA-512.

If your compliance team requires a certificate that doesn’t reference a SHA-1 root, the best approach is to use a custom SSL certificate from another Certificate Authority (CA) and upload it to Azure.

Get an SSL certificate from a trusted CA that only uses SHA-2 or higher in its root and intermediate certificates. Some common options are Let’s Encrypt, GlobalSign, or Sectigo.

Store and manage the certificate in Azure Key Vault for better security and automatic renewal.

Attach the certificate to your Azure services, like Application Gateway, Front Door, or Web Apps, to replace the default Azure Managed SSL Certificate.

Hope it helps!

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-03-04T07:50:41.95+00:00

Hello Irakli Lomidze,

Following up to see if the above suggestions were helpful. And, if you have any further query, please do let us know.
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-03-05T02:31:11.1466667+00:00

Hello Irakli Lomidze,

Following up to see if the above suggestions were helpful. And, if you have any further query, please do let us know.
Savvas Konstantinou 0 Reputation points

2025-05-07T11:53:40.27+00:00

I've also stumbled upon the same issue today.

I think the real question here is whether there is any plan to update the DigiCert Global Root CA which still references the insecure SHA-1.

@SrideviM although the actual certificates used for securing traffic (subordinate and end-entity certificates) are signed with stronger algorithms, please do consider that most PCI compliance authorities do consider the entire certificate chain in their scans (and thus failing us).

Is this the official answer from Microsoft ? If you don't like it bring your own certificate? Don't know if is just me but I kind of expected more here.
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-05-08T00:44:11.61+00:00
Hello Savvas Konstantinou,

You’ve raised a very valid point, especially for teams working under strict compliance checks.

At the moment, Azure Managed Certificates are issued under the DigiCert Global Root CA, which does have a SHA-1 signature. Even though the certificates used for actual traffic are signed with SHA-2 algorithms like SHA-256, some PCI compliance scanners still flag the root certificate because of the SHA-1 signature.

Microsoft hasn’t shared any update yet about switching to a different root or removing SHA-1 from the chain. So yes, if this is causing compliance failures, the current recommendation is to use a custom SSL certificate from a CA that only uses SHA-2 in its full chain.

You can check Microsoft’s official documentation here:

https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate

Hopefully Microsoft considers adding more flexible options in the future, especially for regulated industries.

Your answer

Ankush Raj 410 Reputation points Microsoft Employee

2025-02-24T04:43:36.41+00:00

Hi @Irakli Lomidze

I assume you're facing issue with SHA-1 signature (correct me if I'm wrong)

To help me understand better, could you please expand on the issue you're facing in detail and what do you aim to achieve?

Thanks.
Irakli Lomidze 96 Reputation points

2025-02-24T11:13:30.94+00:00

That is exactly the issue I'm referring to.

Unfortunately, I don't know how I can open the case for that security issue.

Every Managed SSL Certificate by Microsoft are signed that root certificate
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-03-03T06:02:01.67+00:00

Hello Irakli Lomidze,

I understand your concern. Azure Managed SSL Certificates are signed by the DigiCert Global Root CA, which still references SHA-1. However, Microsoft has transitioned all TLS/SSL encryption to SHA-2 and higher for security.

While the root certificate still has a SHA-1 signature, it does not affect the encryption strength of SSL/TLS connections. The actual certificates used for securing traffic (subordinate and end-entity certificates) are signed with stronger algorithms like SHA-256, SHA-384, or SHA-512.

If your compliance team requires a certificate that doesn’t reference a SHA-1 root, the best approach is to use a custom SSL certificate from another Certificate Authority (CA) and upload it to Azure.

Get an SSL certificate from a trusted CA that only uses SHA-2 or higher in its root and intermediate certificates. Some common options are Let’s Encrypt, GlobalSign, or Sectigo.

Store and manage the certificate in Azure Key Vault for better security and automatic renewal.

Attach the certificate to your Azure services, like Application Gateway, Front Door, or Web Apps, to replace the default Azure Managed SSL Certificate.

Hope it helps!

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-03-04T07:50:41.95+00:00

Hello Irakli Lomidze,

Following up to see if the above suggestions were helpful. And, if you have any further query, please do let us know.
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-03-05T02:31:11.1466667+00:00

Hello Irakli Lomidze,

Following up to see if the above suggestions were helpful. And, if you have any further query, please do let us know.
Savvas Konstantinou 0 Reputation points

2025-05-07T11:53:40.27+00:00

I've also stumbled upon the same issue today.

I think the real question here is whether there is any plan to update the DigiCert Global Root CA which still references the insecure SHA-1.

@SrideviM although the actual certificates used for securing traffic (subordinate and end-entity certificates) are signed with stronger algorithms, please do consider that most PCI compliance authorities do consider the entire certificate chain in their scans (and thus failing us).

Is this the official answer from Microsoft ? If you don't like it bring your own certificate? Don't know if is just me but I kind of expected more here.
SrideviM 5,630 Reputation points Microsoft External Staff Moderator

2025-05-08T00:44:11.61+00:00

Hello Savvas Konstantinou,

You’ve raised a very valid point, especially for teams working under strict compliance checks.

At the moment, Azure Managed Certificates are issued under the DigiCert Global Root CA, which does have a SHA-1 signature. Even though the certificates used for actual traffic are signed with SHA-2 algorithms like SHA-256, some PCI compliance scanners still flag the root certificate because of the SHA-1 signature.

Microsoft hasn’t shared any update yet about switching to a different root or removing SHA-1 from the chain. So yes, if this is causing compliance failures, the current recommendation is to use a custom SSL certificate from a CA that only uses SHA-2 in its full chain.

You can check Microsoft’s official documentation here:

https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate

Hopefully Microsoft considers adding more flexible options in the future, especially for regulated industries.

Share via

Security Alert: Azure Managed SSL Certificate issue (DigiCert Global Root CA uses SHA1)

Your answer