{
  "id": 10272880,
  "title": "GitHub Just Killed SHA-1 Over HTTPS",
  "url": "https://urgent.news/2026/09/27/github-just-killed-sha-1-over-https",
  "topic": "world",
  "section": "World",
  "published": "2026-09-27T19:05:52.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shresthapandey/github-just-killed-sha-1-over-https-4nj5"
  },
  "original_language": "en",
  "account": "On September 15, 2026, GitHub permanently disabled SHA-1 for HTTPS and TLS connections on its platforms, including github.com and its content delivery network (CDN). The decision came after a series of warnings and a brownout earlier in the year. If a client could not establish a TLS handshake without SHA-1, a connection error would occur. While the history of SHA-1's use in SSL/TLS handshakes is not covered here, the focus is on the impact of its removal and how to verify your own setup. SHA-1 was primarily used in the TLS handshake, which is the process where a client and server agree on how to verify a certificate. This was kept separate from GitHub's own object hashing system, which uses SHA-256. Old clients were kept alive in the handshake to prevent them from losing connection. The removal process began on April 20, 2026, with an announcement and warning of an upcoming brownout. An 18-hour brownout occurred on July 14, 2026, turning off SHA-1 for just long enough for people to notice. Finally, on September 15, 2026, SHA-1 was turned off permanently. To check your own setup, a simple test can be run using the command `curl -v https://github.dev 2 &1 | grep -i SSL connect | handshake`. A clean connection indicates that the TLS stack is functioning properly, while a handshake error means that the system was likely to fail on the official deadline. This test should be run on various components that interact with GitHub, such as CI runners, servers pulling from GitHub, and internal tools. However, GitHub Enterprise Server (GHES) is not affected by this change. The main issue lies with outdated crypto libraries, such as old curl/libcurl, unpatched .NET Framework builds, and stale Python ssl modules. Many users affected by this change were running infrastructure they had forgotten about. To fix the issue, simply update the TLS library or rebuild the CI base image. After confirming the fix, it is recommended to run the test again to ensure the TLS handshake is working correctly.",
  "summary": "On September 15, 2026, GitHub turned off SHA-1 for HTTPS and TLS on github.com and its CDNs. They had been warning about it since April. If your client can't do a TLS handshake without SHA-1, you now get a connection error. I'll skip the history lesson on SHA-1. What I want to cover is why this took until 2026 to finally happen, and how to check your own setup first. Why was SHA-1 still around…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}