<commit_before>## SHAAAAAAAAAAAAA

_**Do you have the latest SHA??**_

Your SSL certificate was signed using a one-way hashing algorithm when it was created. It was probably SHA-1.

Which is too bad, because **SHA-1 is dangerously weak**, and **SHA-2 is the replacement**.

Test your site's certificate by visiting [shaaaaaaaaaaaaa.com](https://shaaaaaaaaaaaaa.com):

> https://shaaaaaaaaaaaaa.com/check/yourdomain.com

You can also use this repo's `./bin/shaaaaaaaaaaaaa` script to get an answer on the command line, or visit the excellent [SSL Labs](https://www.ssllabs.com/ssltest/analyze.html) for a far more comprehensive review of your SSL configuration.

This repository contains the code for [shaaaaaaaaaaaaa.com](https://shaaaaaaaaaaaaa.com). It depends on `openssl`.

#### Do I have to care?

**Yes.** Be a part of the solution.

SHA-1 was [broken in 2005](https://www.schneier.com/blog/archives/2005/02/sha1_broken.html), and one estimate suggests that in 2014 [it costs $1-2 million](https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html) to forge a SHA-1 certificate. That's nothing.

Eventually, browsers and OSes will distrust SHA-1:

* In 2013, [Microsoft deprecated SHA-1](http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx) for Windows and Internet Explorer.
* In 2014, [the Chromium team deprecated SHA-1](https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/2-R4XziFc7A/YO0ZSrX_X4wJ) for Chrome.

They've promised dire consequences in 2016 and 2017, but they'll only be able to follow through on their threat if enough people update their certs before then.

The last time this happened was with [MD5](http://en.wikipedia.org/wiki/MD5). MD5 was first shown to be weak in **1996**, and Chrome wasn't able to remove MD5 support until **[December 2011](https://code.google.com/p/chromium/issues/detail?id=101123#c15)**.

It's 2014, and the overwhelming number of certificates in the wild today -- including those of leaders like Google -- are SHA-1.

If you're using a SHA-1 cert, take a few minutes and generate a new one with SHA-2.

#### How do I make a SHA-2 certificate?

When you're generating your certificate request, include the `-sha256` parameter:

```
openssl req -new -sha256 -key my-private.key -out mydomain.csr
```

That will instruct the certificate authority to use SHA-256 (a form of SHA-2) when generating your certificate.

For more information on generating and installing a certificate, see:

* this author's [guide to setting up HTTPS](https://konklone.com/post/switch-to-https-now-for-free#generating-the-certificate)
* this author's [nginx configuration](https://gist.github.com/konklone/6532544) that produces [this SSL Labs rating](https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com)

## Author

This is a tiny tool by [<NAME>](https://twitter.com/konklone). Released under an [MIT License](LICENSE).<commit_msg>can't keep 2 parallel treatises up to date<commit_after>## SHAAAAAAAAAAAAA

_**Do you have the latest SHA??**_

Your SSL certificate was signed using a one-way hashing algorithm when it was created. It was probably SHA-1.

Which is too bad, because **SHA-1 is dangerously weak**, and **SHA-2 is the replacement**.

Test your site's certificate by visiting [shaaaaaaaaaaaaa.com](https://shaaaaaaaaaaaaa.com):

> https://shaaaaaaaaaaaaa.com/check/yourdomain.com

You can also use this repo's `./bin/shaaaaaaaaaaaaa` script to get an answer on the command line, or visit the excellent [SSL Labs](https://www.ssllabs.com/ssltest/analyze.html) for a far more comprehensive review of your SSL configuration.

This repository contains the code for [shaaaaaaaaaaaaa.com](https://shaaaaaaaaaaaaa.com). It depends on `openssl`.

#### Do I have to care?

**Yes.** Go [read the website](https://shaaaaaaaaaaaaa.com/)and be a part of the solution.

#### How do I make a SHA-2 certificate?

When you're generating your certificate request, include the `-sha256` parameter:

```
openssl req -new -sha256 -key my-private.key -out mydomain.csr
```

That will instruct the certificate authority to use SHA-256 (a form of SHA-2) when generating your certificate.

For more information on generating and installing a certificate, see:

* this author's [guide to setting up HTTPS](https://konklone.com/post/switch-to-https-now-for-free#generating-the-certificate)
* this author's [nginx configuration](https://gist.github.com/konklone/6532544) that produces [this SSL Labs rating](https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com)

## Author

This is a tiny tool by [<NAME>](https://twitter.com/konklone). Released under an [MIT License](LICENSE).
{'fraction_non_alphanumeric': 0.11493018259935553, 'fraction_numerical': 0.02749731471535983, 'mean_word_length': 4.609638554216867, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 7, 'https://': 21, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 15, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6009072', 'n_tokens_mistral': 1506, 'n_tokens_neox': 1375, 'n_words': 521}