Note that it's insufficient to verify that the certificate contains an SHA-2 signature. You need to check that none of the intermediate certificates in the chain up to the root are signed with SHA-1.
NSS features an environment variable, NSS_HASH_ALG_SUPPORT, which can be used to control what hashing algorithms are available to progams using the library. This environment variable will be respected by a number of programs, including Firefox, and by curl
if it's compiled with NSS support (as it is on, for example, Red Hat Enterprise Linux and Fedora).
curl -V | fgrep NSS/
env NSS_HASH_ALG_SUPPORT=-SHA-1 curl -v --head https://www.google.com/
If curl
is compiled with NSS support, and an SHA-1 certificate is in use, the output will look like:
curl 7.40.0 (x86_64-redhat-linux-gnu) libcurl/7.40.0 NSS/3.18 Basic ECC zlib/1.2.8 libidn/1.29 libssh2/1.5.0
* Trying 64.233.166.104...
* Connected to www.google.com (64.233.166.104) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: CN=www.google.com,O=Google Inc,L=Mountain View,ST=California,C=US
* start date: Jun 03 09:26:01 2015 GMT
* expire date: Sep 01 00:00:00 2015 GMT
* common name: www.google.com
* issuer: CN=Google Internet Authority G2,O=Google Inc,C=US
* NSS error -8016 (SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED)
* The certificate was signed using a signature algorithm that is disabled because it is not secure.
* Closing connection 0
curl: (60) The certificate was signed using a signature algorithm that is disabled because it is not secure.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
Exit 60