Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

High

Weak Certificate Signature Algorithm

Your SSL/TLS certificate uses a weak signature algorithm (such as SHA-1 with RSA PKCS#1) that is vulnerable to collision attacks.

Risk

SHA-1 signatures can be forged through collision attacks, allowing an attacker to create a fraudulent certificate that appears valid. This enables man-in-the-middle attacks where the attacker can impersonate your site, intercept all traffic, and steal sensitive data. Browsers display warnings or reject SHA-1 certificates entirely.

Solution

Reissue your SSL certificate with SHA-256 (or stronger) signature algorithm. Most modern Certificate Authorities issue SHA-256 by default. Contact your CA or hosting provider to reissue the certificate.

Example

openssl req -new -sha256 -key server.key -out server.csr

SHA-1 Deprecation - CA/Browser Forum

Comments (0)

No messages yet.