GitHub Disables SHA-1 in HTTPS to Strengthen Security
September 16, 2026
Phasing Out SHA-1: A Necessary Security Upgrade
On September 15, 2026, GitHub disabled SHA-1 hashing algorithm in HTTPS connections for github.com and its partners. This decision aligns with the broader industry move to retire SHA-1 due to its vulnerabilities.
Why Disable SHA-1?
SHA-1 has been considered weak and susceptible to collision attacks for years. Continuing to support it can expose users to risks such as man-in-the-middle attacks, compromising privacy and data integrity.
What This Means for Users and Partners
By disabling SHA-1, GitHub ensures that all HTTPS connections use more secure cryptographic algorithms like SHA-256. Partners and users are encouraged to verify their systems support modern protocols to maintain seamless connectivity.
Looking Ahead
This change is part of an ongoing effort to maintain the highest standards of security, fostering trust and reliability for the GitHub platform and its ecosystem.
Staying informed about cryptographic best practices remains essential for developers and organizations working in today's security landscape.