<commit_before><!--
  SHAAAAAAAAAAAAA

  Built and maintained by <NAME>. (@konklone, konklone.com)

  More background:
  https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1

  A Node app, with Express for a web server. Uses the openssl
  command line tool to download SSL certificates.

  Open source, under a MIT license:
  https://github.com/konklone/shaaaaaaaaaaaaa

  Thanks to <NAME> for the inspiration.
-->

<!doctype html>
<html lang="en">
<head>

<title>
  SHAAAAAAAAAAAAA | Check your site for weak SHA-1 certificates.
</title>
<meta name="og:title" content="SHAAAAAAAAAAAAA | Check your site for weak SHA-1 certificates." />
<meta name="description" content="SHA-1 certificates are dangerously weak, and you probably have one. It's time to upgrade to SHA-2. Open source tool by @konklone." />
<meta name="og:description" content="SHA-1 certificates are dangerously weak, and you probably have one. It's time to upgrade to SHA-2. Open source tool by @konklone." />

<meta charset="utf-8" />
<meta name="viewport" content="width=device-width,initial-scale=1" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta property="og:site_name" content="SHAAAAAAAAAAAAA.com">


<meta name="author" content="<NAME>" />

<meta name="twitter:creator" content="@konklone" />
<meta name="twitter:creator:id" content="5232171" />
<meta name="twitter:site" content="@konklone" />
<meta name="twitter:site:id" content="5232171" />
<meta name="twitter:url" content="https://shaaaaaaaaaaaaa.com" />

<meta name="og:image" content="https://konklone.com/assets/images/blog/sha-1/shaaaaa-site.png" />
<meta name="twitter:card" content="summary_large_image" />

<link rel="vcs-git" href="https://github.com/konklone/shaaaaaaaaaaaaa" title="code for shaaaaaaaaaaaaa.com" />

<link rel="shortcut icon" href="/favicon.png" />
<link rel="canonical" href="https://shaaaaaaaaaaaaa.com<%= req.originalUrl %>" />

<link href="https://fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,400,700|Average" rel="stylesheet" type="text/css" />
<link rel="stylesheet" href="/css/pure-min-0.5.0.css" />
<link rel="stylesheet" href="/css/main.css?<%= Date.now() %>" />

<script src="/js/jquery-2.1.1.min.js"></script>

</head>
<body>

<div id="main">

  <h1>SHAAAAAAAAAAAAA</h1>

  <header>
    <p>
      Check your site for weak SHA-1 certificates. <a href="https://github.com/konklone/shaaaaaaaaaaaaa">Open source</a>, by <a href="https://twitter.com/konklone">@konklone</a>.
    </p>
  </header>

  <div id="results">
    <div class="result form">
      <form action="#" class="pure-form" method="get">
        <input pattern="[\w\.\-:]+" id="domain" name="domain" placeholder="yourdomain.com" autofocus />
        <input type="submit" class="pure-button pure-button-primary" value="Go" />

        <span class="inline-block" id="loading">
          If it hangs, <a href="#" class="start-over">start over</a>.
        </span>

      </form>
    </div>

    <div class="result answer">

      <strong class="word good">Nice.</strong>
      <strong class="word almost">Almost.</strong>
      <strong class="word bad">Dang.</strong>

      <p class="details good">
        <span class="domain"></span> has a verifiable certificate chain signed with <span class="algorithm"></span><span class="extra"></span>.
      </p>

      <p class="details almost">
        <span class="domain"></span> has a <span class="algorithm"></span> certificate, but needs to <a href="#sha2-intermediate">update its intermediates</a><span class="extra"></span>.
      </p>

      <p class="details bad">
        <span class="domain"></span> is using <span class="algorithm"></span><span class="extra"></span>.
      </p>

      <!-- <ul class="data">
        <h5>Certificate details</h5>
        <li>
          <span class="cert">Client:</span>
          <span class="algorithm">SHA-2</span>,
          <span class="name">twitter.com</span>
        </li>
        <li>
          <span class="cert">Intermediate:</span>
          <span class="algorithm">SHA-1</span>,
          <span class="name">VeriSign Class 3 Extended Validation SSL CA</span>
        </li>

      </ul> -->

      <p>
        See the details at <a class="ssllabs" href="#">SSL Labs</a>, or <a href="#" class="start-over">start over</a>.
      </p>
    </div>

    <div class="result error">
      <strong class="word error">Argh.</strong>

      <p class="error">
        There was an error checking <span class="domain"></span>. Check the developer console for details.
      </p>

      <p>
        <a href="#" class="start-over">Start over.</a>
      </p>
    </div>
  </div>

  <div class="lead">
    <p>
      SSL certificates are signed using a one-way hash &mdash; usually SHA-1.
    </p>

    <p>
      Which is too bad, because <strong>SHA-1 is <a href="https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1">becoming dangerously weak</a></strong>. It's time to <strong>upgrade to SHA-2</strong>.
    </p>
  </div>

  <p>
    SHA-1 was <a href="https://www.schneier.com/blog/archives/2005/02/sha1_broken.html">first shown to be broken in 2005</a>, and one estimate suggests that in 2014 <a href="https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html">it costs $1-2 million</a> to forge a SHA-1 certificate. For some actors, that's nothing.
  </p>

  <p>
    The only way to solve this is for everyone to turn off support for SHA-1. <a href="http://news.netcraft.com/archives/2014/05/05/sha-2-very-cryptographic-so-secure-such-growth-wow.html">That curve is bending</a>, but there's a long way to go.
  </p>
  <p>
    <a href="http://arstechnica.com/security/2013/11/hoping-to-avert-collision-with-disaster-microsoft-retires-sha1/">Microsoft</a>, <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html">Chrome</a>, and <a href="https://wiki.mozilla.org/CA:Problematic_Practices#SHA-1_Certificates">Firefox</a> all recently deprecated SHA-1, and plan to turn it off in 2017.
  </p>

  <p>
    In fact, Chrome will <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html">start showing warnings</a> over the <strong>next few months</strong> for any site using a SHA-1 certificate that expires in 2017.
  </p>

  <p>
    <a target="_blank" href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html"><img src="/chrome-warnings.png" style="display: block; border: 1px solid #eee; margin: 0 auto" /></a>
  </p>

  <p>
    It's worth taking the time to get off SHA-1. Read <a href="https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1">more about how SHA-1 works and why this is happening</a>.
  </p>

  <h2>
    <a name="sha2-certificate" href="#sha2-certificate"></a>
    Getting a SHA-2 certificate
  </h2>

  <p>
    You'll need to <a href="https://konklone.com/post/switch-to-https-now-for-free#generating-the-certificate">generate a new certificate request</a>, and get your CA to issue you a new certificate using SHA-2. Using your existing private key:
  </p>

  <p>
    <code>openssl req -new <strong>-sha256</strong> -key your-private.key -out your-domain.csr</code>
  </p>

  <p>
    Some CAs now default to SHA-2, some need you to "request" it, either in writing or even by signing your CSR with SHA-2. Some CAs don't support SHA-2 at all yet.
  </p>

  <ul>
    <li>
      <strong>With <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap</a></strong>, choose a Comodo cert, because some of the others <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24#issuecomment-53441453">may not obey your SHA-2 request</a> unless you spend time with customer support.
    </li>
    <li>
      <strong><a href="https://www.godaddy.com/ssl/ssl-certificates.aspx">GoDaddy</a></strong> <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24#issuecomment-53438159">may still issue you a SHA-1 cert</a> at first. If so, you need to <a href="http://support.godaddy.com/help/article/4976/re-keying-an-ssl-certificate?locale=en">"re-key" your certificate</a> to get one signed with SHA-2.
    </li>
    <li>
      <strong><a href="https://www.digicert.com/ssl-certificate.htm">Digicert</a></strong> issues SHA-2 certificates by default. However, if you "re-key" an existing SHA-1 certificate, you need to select SHA-2 as an "advanced option" on the cerificate request page.
    </li>
    <li>
      <strong><a href="https://www.startssl.com">StartSSL</a></strong> uses SHA-2 by default for new certificates. If you need to reissue an old one, you may find <a href="https://kuix.de/blog/index.php?entry=SSL/TLS-servers,-SHA-1/SHA-256-and-StartSSL.com-certificates">Kai Engert's trick</a> of using a fake subdomain to avoid revocation fees helpful. (Requires a paid class 2 identity verification.)
    </li>
    <li>
      <strong>If <a href="https://products.geotrust.com/orders/orderinformation/authentication.do">GeoTrust or RapidSSL</a></strong> mistakenly issue you a SHA-1 again, follow <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24#issuecomment-54021941">these instructions</a> to login to their portal and reissue your certificate.
    </li>
    <li>
      <strong><a href="https://dnsimple.com/ssl-certificate">DNSimple</a></strong> has <a href="http://support.dnsimple.com/articles/sha-2-ssl-certificates/">now switched to SHA-2 certs by default</a>, so re-issue if you need to.
    </li>
    <li>
      <strong><a href="http://www.gandi.net/support/contact/mail/">Gandi</a></strong>, <a href="https://twitter.com/gandibar/status/508001036653826049">doesn't support SHA-2 yet</a>, but says <a href="https://twitter.com/gandibar/status/509116131173748736">they're working on it</a>.
    </li>
  </ul>

  <p>
    If you find other problems, please <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24">report them here</a> and I'll update the list above.
  </p>

  <h2>
    <a name="sha2-intermediate" href="#sha2-intermediate"></a>
    Using SHA-2 intermediate certificates
  </h2>

  <p>
    When you created your certificate chain, you included one or more <a href="http://www.whichssl.com/intermediate_certificates2.html">intermediate certificates</a> from wherever you bought your cert, which may need to be updated. Check <a class="ssllabs" href="https://www.ssllabs.com/ssltest/analyze.html">SSL Labs</a> to see if you need to update.
  </p>

  <ul>
    <li>
      <strong>If using <a href="https://www.dreamhost.com/">Dreamhost</a></strong>, someone kindly documented <a href="https://discussion.dreamhost.com/thread-143863.html">where to get the appropriate SHA-2 intermediates</a>.
    </li>
    <li>
      <strong><a href="https://www.rapidssl.com/">RapidSSL</a></strong> has <a href="https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&actp=CROSSLINK&id=SO26459">SHA-2 intermediates</a>. Because these were issued recently, you <strong>may need to reissue your client cert</strong> from RapidSSL as well (even a SHA-2 cert) to ensure you get a client cert that was signed by these intermediates.
    </li>
    <li>
      <strong><a href="https://www.startssl.com">StartSSL</a></strong> has updated SHA-2 certificates for whatever level you've paid for: <a href="https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem">Class 1</a>, <a href="https://www.startssl.com/certs/class2/sha2/pem/sub.class2.server.sha2.ca.pem">Class 2</a>, <a href="https://www.startssl.com/certs/class3/sha2/pem/sub.class3.server.sha2.ca.pem">Class 3</a>, or <a href="https://www.startssl.com/certs/class4/sha2/pem/sub.ev.server.sha2.ca.pem">Class 4</a>.
    </li>

    <li>
      If you're using <strong><a href="http://ssl.comodo.com/">Comodo</a></strong> (possibly through <strong><a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap</a></strong>), download the <a href="https://support.comodo.com/index.php?/Default/Knowledgebase/List/Index/106/downloads">SHA-2 intermediate</a> that corresponds to your certificate level.
    </li>

    <li>
      <strong><a href="https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR657&actp=LIST&viewlocale=en_US">Verisign / Symantec</a></strong> lists their SHA-2 intermediates under <strong>RSA SHA-2</strong>, at "SHA-2 Intermediate CAs under SHA-2 Root".
    </li>

    <li>
      For <strong><a href="https://www.geotrust.com/">GeoTrust</a></strong>, check out <a href="https://ssl-tools.net/certificates/nakw2x-rapidssl-sha256-ca-g3">this intermediate</a> or <a href="https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1421&actp=LIST&viewlocale=en_US">dig through their list</a>. If you're using their "Geotrust True Business ID Wildcard" product, you will need to email support to get them to send you the right intermediate(!).
    </li>

    <li>
      If you're using <strong><a href="https://www.globalsign.com/ssl/">GlobalSign or AlphaSSL</a></strong>, get their SHA-2 <a href="https://www.globalsign.com/repository/ca-certificates/">intermediate certificates</a>.
    </li>

    <li>
      <strong><a href="https://www.digicert.com/ssl-certificate.htm">Digicert</a></strong>has <a href="https://www.digicert.com/digicert-root-certificates.htm#intermediates">SHA-2 intermediates</a> for everything.
    </li>
  </ul>

  <h2>
    <a name="credits" href="#credits"></a>
    Credits
  </h2>

  <p>
    This website is an <a href="https://github.com/konklone/shaaaaaaaaaaaaa">open source</a> project, and includes a <a href="https://github.com/konklone/shaaaaaaaaaaaaa#command-line-version">command line tool</a> &mdash; please <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues">lend a hand</a>!
  </p>

  <p>
    Thanks to <a href="https://twitter.com/mathias"><NAME></a>, <a href="https://twitter.com/jmayer"><NAME></a>, and <a href="https://twitter.com/jonnybarnes"><NAME></a> for inspiration and assistance.
  </p>

</div>

<script src="/js/main.js"></script>
<script>
  <% if (domain) { %>
  var domain = "<%= helpers.escape_attribute(domain) %>";
  <% } else { %>
  var domain = null;
  <% } %>

  $(function() {
    if (domain) {
      $("#domain").val(domain);
      checkDomain(domain);
    }
  });
</script>

<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-252618-19', 'shaaaaaaaaaaaaa.com');
  ga('send', 'pageview');

  // Anonymize user IPs (cut off the last triplet).
  ga('set', 'anonymizeIp', true);
</script>

</body>
</html>
<commit_msg>note startssl's dependency on signing algorithm, cc @GreenReaper<commit_after><!--
  SHAAAAAAAAAAAAA

  Built and maintained by <NAME>. (@konklone, konklone.com)

  More background:
  https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1

  A Node app, with Express for a web server. Uses the openssl
  command line tool to download SSL certificates.

  Open source, under a MIT license:
  https://github.com/konklone/shaaaaaaaaaaaaa

  Thanks to <NAME> for the inspiration.
-->

<!doctype html>
<html lang="en">
<head>

<title>
  SHAAAAAAAAAAAAA | Check your site for weak SHA-1 certificates.
</title>
<meta name="og:title" content="SHAAAAAAAAAAAAA | Check your site for weak SHA-1 certificates." />
<meta name="description" content="SHA-1 certificates are dangerously weak, and you probably have one. It's time to upgrade to SHA-2. Open source tool by @konklone." />
<meta name="og:description" content="SHA-1 certificates are dangerously weak, and you probably have one. It's time to upgrade to SHA-2. Open source tool by @konklone." />

<meta charset="utf-8" />
<meta name="viewport" content="width=device-width,initial-scale=1" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta property="og:site_name" content="SHAAAAAAAAAAAAA.com">


<meta name="author" content="<NAME>" />

<meta name="twitter:creator" content="@konklone" />
<meta name="twitter:creator:id" content="5232171" />
<meta name="twitter:site" content="@konklone" />
<meta name="twitter:site:id" content="5232171" />
<meta name="twitter:url" content="https://shaaaaaaaaaaaaa.com" />

<meta name="og:image" content="https://konklone.com/assets/images/blog/sha-1/shaaaaa-site.png" />
<meta name="twitter:card" content="summary_large_image" />

<link rel="vcs-git" href="https://github.com/konklone/shaaaaaaaaaaaaa" title="code for shaaaaaaaaaaaaa.com" />

<link rel="shortcut icon" href="/favicon.png" />
<link rel="canonical" href="https://shaaaaaaaaaaaaa.com<%= req.originalUrl %>" />

<link href="https://fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,400,700|Average" rel="stylesheet" type="text/css" />
<link rel="stylesheet" href="/css/pure-min-0.5.0.css" />
<link rel="stylesheet" href="/css/main.css?<%= Date.now() %>" />

<script src="/js/jquery-2.1.1.min.js"></script>

</head>
<body>

<div id="main">

  <h1>SHAAAAAAAAAAAAA</h1>

  <header>
    <p>
      Check your site for weak SHA-1 certificates. <a href="https://github.com/konklone/shaaaaaaaaaaaaa">Open source</a>, by <a href="https://twitter.com/konklone">@konklone</a>.
    </p>
  </header>

  <div id="results">
    <div class="result form">
      <form action="#" class="pure-form" method="get">
        <input pattern="[\w\.\-:]+" id="domain" name="domain" placeholder="yourdomain.com" autofocus />
        <input type="submit" class="pure-button pure-button-primary" value="Go" />

        <span class="inline-block" id="loading">
          If it hangs, <a href="#" class="start-over">start over</a>.
        </span>

      </form>
    </div>

    <div class="result answer">

      <strong class="word good">Nice.</strong>
      <strong class="word almost">Almost.</strong>
      <strong class="word bad">Dang.</strong>

      <p class="details good">
        <span class="domain"></span> has a verifiable certificate chain signed with <span class="algorithm"></span><span class="extra"></span>.
      </p>

      <p class="details almost">
        <span class="domain"></span> has a <span class="algorithm"></span> certificate, but needs to <a href="#sha2-intermediate">update its intermediates</a><span class="extra"></span>.
      </p>

      <p class="details bad">
        <span class="domain"></span> is using <span class="algorithm"></span><span class="extra"></span>.
      </p>

      <!-- <ul class="data">
        <h5>Certificate details</h5>
        <li>
          <span class="cert">Client:</span>
          <span class="algorithm">SHA-2</span>,
          <span class="name">twitter.com</span>
        </li>
        <li>
          <span class="cert">Intermediate:</span>
          <span class="algorithm">SHA-1</span>,
          <span class="name">VeriSign Class 3 Extended Validation SSL CA</span>
        </li>

      </ul> -->

      <p>
        See the details at <a class="ssllabs" href="#">SSL Labs</a>, or <a href="#" class="start-over">start over</a>.
      </p>
    </div>

    <div class="result error">
      <strong class="word error">Argh.</strong>

      <p class="error">
        There was an error checking <span class="domain"></span>. Check the developer console for details.
      </p>

      <p>
        <a href="#" class="start-over">Start over.</a>
      </p>
    </div>
  </div>

  <div class="lead">
    <p>
      SSL certificates are signed using a one-way hash &mdash; usually SHA-1.
    </p>

    <p>
      Which is too bad, because <strong>SHA-1 is <a href="https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1">becoming dangerously weak</a></strong>. It's time to <strong>upgrade to SHA-2</strong>.
    </p>
  </div>

  <p>
    SHA-1 was <a href="https://www.schneier.com/blog/archives/2005/02/sha1_broken.html">first shown to be broken in 2005</a>, and one estimate suggests that in 2014 <a href="https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html">it costs $1-2 million</a> to forge a SHA-1 certificate. For some actors, that's nothing.
  </p>

  <p>
    The only way to solve this is for everyone to turn off support for SHA-1. <a href="http://news.netcraft.com/archives/2014/05/05/sha-2-very-cryptographic-so-secure-such-growth-wow.html">That curve is bending</a>, but there's a long way to go.
  </p>
  <p>
    <a href="http://arstechnica.com/security/2013/11/hoping-to-avert-collision-with-disaster-microsoft-retires-sha1/">Microsoft</a>, <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html">Chrome</a>, and <a href="https://wiki.mozilla.org/CA:Problematic_Practices#SHA-1_Certificates">Firefox</a> all recently deprecated SHA-1, and plan to turn it off in 2017.
  </p>

  <p>
    In fact, Chrome will <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html">start showing warnings</a> over the <strong>next few months</strong> for any site using a SHA-1 certificate that expires in 2017.
  </p>

  <p>
    <a target="_blank" href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html"><img src="/chrome-warnings.png" style="display: block; border: 1px solid #eee; margin: 0 auto" /></a>
  </p>

  <p>
    It's worth taking the time to get off SHA-1. Read <a href="https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1">more about how SHA-1 works and why this is happening</a>.
  </p>

  <h2>
    <a name="sha2-certificate" href="#sha2-certificate"></a>
    Getting a SHA-2 certificate
  </h2>

  <p>
    You'll need to <a href="https://konklone.com/post/switch-to-https-now-for-free#generating-the-certificate">generate a new certificate request</a>, and get your CA to issue you a new certificate using SHA-2. Using your existing private key:
  </p>

  <p>
    <code>openssl req -new <strong>-sha256</strong> -key your-private.key -out your-domain.csr</code>
  </p>

  <p>
    Some CAs now default to SHA-2, some need you to "request" it, either in writing or even by signing your CSR with SHA-2. Some CAs don't support SHA-2 at all yet.
  </p>

  <ul>
    <li>
      <strong>With <a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap</a></strong>, choose a Comodo cert, because some of the others <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24#issuecomment-53441453">may not obey your SHA-2 request</a> unless you spend time with customer support.
    </li>
    <li>
      <strong><a href="https://www.godaddy.com/ssl/ssl-certificates.aspx">GoDaddy</a></strong> <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24#issuecomment-53438159">may still issue you a SHA-1 cert</a> at first. If so, you need to <a href="http://support.godaddy.com/help/article/4976/re-keying-an-ssl-certificate?locale=en">"re-key" your certificate</a> to get one signed with SHA-2.
    </li>
    <li>
      <strong><a href="https://www.digicert.com/ssl-certificate.htm">Digicert</a></strong> issues SHA-2 certificates by default. However, if you "re-key" an existing SHA-1 certificate, you need to select SHA-2 as an "advanced option" on the cerificate request page.
    </li>
    <li>
      <strong><a href="https://www.startssl.com">StartSSL</a></strong> uses SHA-2 new certificates, as long as you <strong>use the -sha256 flag above</strong> when creating the CSR. If you need to reissue an old one, you may find <a href="https://kuix.de/blog/index.php?entry=SSL/TLS-servers,-SHA-1/SHA-256-and-StartSSL.com-certificates">Kai Engert's trick</a> of using a fake subdomain to avoid revocation fees helpful. (Requires a paid class 2 identity verification.)
    </li>
    <li>
      <strong>If <a href="https://products.geotrust.com/orders/orderinformation/authentication.do">GeoTrust or RapidSSL</a></strong> mistakenly issue you a SHA-1 again, follow <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24#issuecomment-54021941">these instructions</a> to login to their portal and reissue your certificate.
    </li>
    <li>
      <strong><a href="https://dnsimple.com/ssl-certificate">DNSimple</a></strong> has <a href="http://support.dnsimple.com/articles/sha-2-ssl-certificates/">now switched to SHA-2 certs by default</a>, so re-issue if you need to.
    </li>
    <li>
      <strong><a href="http://www.gandi.net/support/contact/mail/">Gandi</a></strong>, <a href="https://twitter.com/gandibar/status/508001036653826049">doesn't support SHA-2 yet</a>, but says <a href="https://twitter.com/gandibar/status/509116131173748736">they're working on it</a>.
    </li>
  </ul>

  <p>
    If you find other problems, please <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues/24">report them here</a> and I'll update the list above.
  </p>

  <h2>
    <a name="sha2-intermediate" href="#sha2-intermediate"></a>
    Using SHA-2 intermediate certificates
  </h2>

  <p>
    When you created your certificate chain, you included one or more <a href="http://www.whichssl.com/intermediate_certificates2.html">intermediate certificates</a> from wherever you bought your cert, which may need to be updated. Check <a class="ssllabs" href="https://www.ssllabs.com/ssltest/analyze.html">SSL Labs</a> to see if you need to update.
  </p>

  <ul>
    <li>
      <strong>If using <a href="https://www.dreamhost.com/">Dreamhost</a></strong>, someone kindly documented <a href="https://discussion.dreamhost.com/thread-143863.html">where to get the appropriate SHA-2 intermediates</a>.
    </li>
    <li>
      <strong><a href="https://www.rapidssl.com/">RapidSSL</a></strong> has <a href="https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&actp=CROSSLINK&id=SO26459">SHA-2 intermediates</a>. Because these were issued recently, you <strong>may need to reissue your client cert</strong> from RapidSSL as well (even a SHA-2 cert) to ensure you get a client cert that was signed by these intermediates.
    </li>
    <li>
      <strong><a href="https://www.startssl.com">StartSSL</a></strong> has updated SHA-2 certificates for whatever level you've paid for: <a href="https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem">Class 1</a>, <a href="https://www.startssl.com/certs/class2/sha2/pem/sub.class2.server.sha2.ca.pem">Class 2</a>, <a href="https://www.startssl.com/certs/class3/sha2/pem/sub.class3.server.sha2.ca.pem">Class 3</a>, or <a href="https://www.startssl.com/certs/class4/sha2/pem/sub.ev.server.sha2.ca.pem">Class 4</a>.
    </li>

    <li>
      If you're using <strong><a href="http://ssl.comodo.com/">Comodo</a></strong> (possibly through <strong><a href="https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx">Namecheap</a></strong>), download the <a href="https://support.comodo.com/index.php?/Default/Knowledgebase/List/Index/106/downloads">SHA-2 intermediate</a> that corresponds to your certificate level.
    </li>

    <li>
      <strong><a href="https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR657&actp=LIST&viewlocale=en_US">Verisign / Symantec</a></strong> lists their SHA-2 intermediates under <strong>RSA SHA-2</strong>, at "SHA-2 Intermediate CAs under SHA-2 Root".
    </li>

    <li>
      For <strong><a href="https://www.geotrust.com/">GeoTrust</a></strong>, check out <a href="https://ssl-tools.net/certificates/nakw2x-rapidssl-sha256-ca-g3">this intermediate</a> or <a href="https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1421&actp=LIST&viewlocale=en_US">dig through their list</a>. If you're using their "Geotrust True Business ID Wildcard" product, you will need to email support to get them to send you the right intermediate(!).
    </li>

    <li>
      If you're using <strong><a href="https://www.globalsign.com/ssl/">GlobalSign or AlphaSSL</a></strong>, get their SHA-2 <a href="https://www.globalsign.com/repository/ca-certificates/">intermediate certificates</a>.
    </li>

    <li>
      <strong><a href="https://www.digicert.com/ssl-certificate.htm">Digicert</a></strong>has <a href="https://www.digicert.com/digicert-root-certificates.htm#intermediates">SHA-2 intermediates</a> for everything.
    </li>
  </ul>

  <h2>
    <a name="credits" href="#credits"></a>
    Credits
  </h2>

  <p>
    This website is an <a href="https://github.com/konklone/shaaaaaaaaaaaaa">open source</a> project, and includes a <a href="https://github.com/konklone/shaaaaaaaaaaaaa#command-line-version">command line tool</a> &mdash; please <a href="https://github.com/konklone/shaaaaaaaaaaaaa/issues">lend a hand</a>!
  </p>

  <p>
    Thanks to <a href="https://twitter.com/mathias"><NAME></a>, <a href="https://twitter.com/jmayer"><NAME></a>, and <a href="https://twitter.com/jonnybarnes"><NAME></a> for inspiration and assistance.
  </p>

</div>

<script src="/js/main.js"></script>
<script>
  <% if (domain) { %>
  var domain = "<%= helpers.escape_attribute(domain) %>";
  <% } else { %>
  var domain = null;
  <% } %>

  $(function() {
    if (domain) {
      $("#domain").val(domain);
      checkDomain(domain);
    }
  });
</script>

<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-252618-19', 'shaaaaaaaaaaaaa.com');
  ga('send', 'pageview');

  // Anonymize user IPs (cut off the last triplet).
  ga('set', 'anonymizeIp', true);
</script>

</body>
</html>

{'fraction_non_alphanumeric': 0.17667560321715817, 'fraction_numerical': 0.020810991957104556, 'mean_word_length': 3.877574370709382, 'pattern_counts': {'":': 0, '<': 771, '<?xml version=': 0, '>': 771, 'https://': 110, 'lorem ipsum': 0, 'www.': 46, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 38, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5748353', 'n_tokens_mistral': 10625, 'n_tokens_neox': 9987, 'n_words': 2357}