Through an article on Security Labs I read about Google deprecating SHA-1 as signature in Chrome next year.

Now I want to edit our HAProxy SSL configuration to fit the new security needs.

What are the recommended ciphers and how do I block HAProxy from using SHA-1 for those signatures mentioned? And how do I check if it is the correct signature method afterwards?

Also, are there performance impacts to expect when switching from SHA-1 to SHA-256?


SHA-256 must be defined when writing a certificate request for your certificate authority and then certificate must be generated with SHA-256 (sometimes called SHA2). Some certificate authorities allow to choose with what hash will certificate be generated when ordering certificate and that overrides certificate request. HAProxy understands such certificates and no additional configuration from it is needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.