Apple Drops Support for SHA-1 Certificates in macOS Catalina and iOS 13 - MacRumorsOpen MenuShow RoundupsShow Forums menuVisit ForumsOpen Sidebar
Skip to Content

Apple Drops Support for SHA-1 Certificates in macOS Catalina and iOS 13

by

In a new support document, Apple has indicated that macOS Catalina and iOS 13 drop support for TLS certificates signed with the SHA-1 hash algorithm, which is now considered to be insecure. SHA-2 is now required at a minimum.

macos catalina safari
Apple says all TLS server certificates must comply with these new security requirements in macOS Catalina and iOS 13:

  • TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.

  • TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.

  • TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.

Effective immediately, any connections to TLS servers violating these new requirements will fail and may cause network failures, apps to fail, and websites to not load in Safari in macOS Catalina and iOS 13, according to Apple.

Google, Microsoft, and Mozilla all deprecated SHA-1 certificates in 2017.

Tags: Safari, SHA-1
Related Forums: iOS 13, macOS Catalina

Popular Stories

MacBook Pro Low Angle Wide Lens

macOS 27: Two More Changes Leaked Ahead of WWDC Next Month

Sunday May 10, 2026 9:45 am PDT by
macOS 27 will have a "slight redesign" compared to macOS Tahoe, according to the latest word from Bloomberg's Mark Gurman. In his Power On newsletter today, Gurman said the design changes will help to improve the readability of macOS Tahoe's Liquid Glass interface:If you've used Tahoe, you're likely familiar with some of the quirks — particularly the transparency effects and shadows that...
Read Full Article • 162 comments
macOS 27 on MacBook Pro

Apple Says macOS 27 Won't Be Compatible With These Macs

Wednesday June 3, 2026 8:29 am PDT by
During WWDC 2025, Apple revealed that macOS 26 Tahoe would be the final major macOS version for Intel-based Macs. macOS 27 will be compatible with Apple silicon Macs only, meaning that you will need a Mac with an M-series chip or a MacBook Neo with an A18 Pro chip in order to install the software update. Apple will unveil macOS 27 during its WWDC 2026 keynote this Monday, June 8, and the...
Read Full Article • 90 comments
MacBook Neo on Yellow Feature

MacBook Neo is So Popular That Apple Reportedly Doubled Production

Wednesday June 3, 2026 9:24 am PDT by
On an earnings call in late April, Apple's CEO Tim Cook said that customer response to the MacBook Neo was "off the charts," and the popularity of the laptop has reportedly led the company to significantly boost production. Apple supply chain analyst Ming-Chi Kuo this week said he believes that MacBook Neo shipments to Apple were doubled from an initial target of 5 million units to 10...
Read Full Article • 114 comments

Top Rated Comments

S
Sasparilla
91 months ago
Nice to see them doing this.

Planned obsolescence...smh...
For an insecure encryption algorithm? I would hope they'd deprecate it (following Google, Firefox etc.).
Score: 17 Votes (Like | Disagree)
keysofanxiety Avatar
keysofanxiety
91 months ago
Planned obsolescence...smh...
I know, it's a disgrace. Little known fact: very few websites work well on Netscape Navigator either :mad:
Score: 5 Votes (Like | Disagree)
SteveOfTheStow Avatar
SteveOfTheStow
91 months ago
For an insecure encryption algorithm? I would hope they'd deprecate it (following Google, Firefox etc.).
There was an implicit /s in vicviper789's post ;)
Score: 5 Votes (Like | Disagree)
D
darngooddesign
91 months ago
There was an implicit /s in vicviper789's post ;)
It’s impossible to tell if someone is being sincere or sarcastic on the internet; which is why we have ‘/s’.
Score: 4 Votes (Like | Disagree)
Soba Avatar
Soba
91 months ago
Planned obsolescence...smh...
I get your point and share the frustration, but it's not warranted in this case.

Encryption algorithms have shelf lives, more or less. Weaknesses are periodically discovered that make them vulnerable to cracking or workarounds, as in this case. Generally these problems cannot be fixed in the way ordinary software is patched because the problems are not specific to any vendor and are simply fundamental flaws in the encryption mechanism; the only solution is abandonment of the encryption method and moving on to safer methods.

SHA-1 is over 25 years old and has been known to have problems since at least 2005. Deprecating encryption methods that are known to be too weak or vulnerable is the right thing to do, and if anything, this move is long overdue.
[doublepost=1559832487][/doublepost]
I know, it's a disgrace. Little known fact: very few websites work well on Netscape Navigator either :mad:
I miss Netscape. ;)

I have to laugh at the 40-bit encryption we used in the late 90s (32-bit in some parts of the world). It wasn't thought overly safe even at the time, but that seems just silly, today.
Score: 4 Votes (Like | Disagree)
L
lunarworks
91 months ago
I miss Netscape. ;)

I have to laugh at the 40-bit encryption we used in the late 90s (32-bit in some parts of the world). It wasn't thought overly safe even at the time, but that seems just silly, today.
Remember when encryption-enabled Netscape was considered a "munition", and was barred from export from the US, so they had a plaintext-only version for the rest of the world?
Score: 2 Votes (Like | Disagree)
Read All Comments