Edit

Share via

EnableSha1ForLocalAnchors

Allow certificates signed using SHA-1 when issued by local trust anchors (obsolete)

OBSOLETE: This policy is obsolete and doesn't work after Microsoft Edge version 91.

Supported versions

  • On Windows and macOS since 85, until 91

Description

When this setting is enabled, Microsoft Edge allows connections secured by SHA-1 signed certificates so long as the the certificate chains to a locally-installed root certificate and is otherwise valid.

Note that this policy depends on the operating system (OS) certificate verification stack allowing SHA-1 signatures. If an OS update changes the OS handling of SHA-1 certificates, this policy might no longer have effect. Further, this policy is intended as a temporary workaround to give enterprises more time to move away from SHA-1. This policy will be removed in Microsoft Edge 92 releasing in mid 2021.

If you don't set this policy or set it to false, or the SHA-1 certificate chains to a publicly trusted certificate root, then Microsoft Edge won't allow certificates signed by SHA-1.

This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain, Windows 10 Pro or Enterprise instances that enrolled for device management, or macOS instances that are that are managed via MDM or joined to a domain via MCX.

Supported features

  • Can be mandatory: Yes
  • Can be recommended: No
  • Dynamic Policy Refresh: Yes
  • Per Profile: No
  • Applies to a profile that is signed in with a Microsoft account: Yes

Data type

  • Boolean

Windows information and settings

Group Policy (ADMX) info

  • GP unique name: EnableSha1ForLocalAnchors
  • GP name: Allow certificates signed using SHA-1 when issued by local trust anchors (obsolete)
  • GP path (Mandatory): Administrative Templates/Microsoft Edge
  • GP path (Recommended): N/A
  • GP ADMX file name: MSEdge.admx

Example value

Disabled

Registry settings

  • Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
  • Path (Recommended): N/A
  • Value name: EnableSha1ForLocalAnchors
  • Value type: REG_DWORD

Example registry value

0x00000000

Mac information and settings

  • Preference Key name: EnableSha1ForLocalAnchors
  • Example value:
<false/>

See also