When browsing any StackExchange site, my Firefox console displays this warning:
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.
To be clear, it's not the SE cert that is at fault, but the CA root certificate.
The warning points to Weak Signature Algorithm for more information.
Whether one chooses to connect via https or not, this is a concern because of mixed content on the sites, and because the GlobalSign Root CA certificate that is the root for *.stackexchange.com has a weak or insecure signature (SHA1 with RSA). That can currently result in a visible warning, depending on which browser is used. Today, actual functionality is unaffected, but should be expected over time.
- (Microsoft) "...expect SHA1 certificates issued after 1/1/2017 may stop working at any time." Internet Explorer will distrust SHA-1 certificates after 2016.
- (Mozilla) Same timeline.
- (Chrome) Is actively sunsetting SHA-1 support. Sites with end-entity (“leaf”) certificates that expire on or after 1 January 2017, and which include a SHA-1-based signature as part of the certificate chain, will be treated as “secure, but with minor errors”. That refers to SE, currently.
Will you be upgrading to more secure certificates at next renewal?