Apple Drops Support for SHA-1 Certificates in macOS Catalina and iOS 13

Thursday June 6, 2019 7:15 am PDT by Joe Rossignol

In a new support document, Apple has indicated that macOS Catalina and iOS 13 drop support for TLS certificates signed with the SHA-1 hash algorithm, which is now considered to be insecure. SHA-2 is now required at a minimum.

macos catalina safari
Apple says all TLS server certificates must comply with these new security requirements in macOS Catalina and iOS 13:

TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.
TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.
TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.

Effective immediately, any connections to TLS servers violating these new requirements will fail and may cause network failures, apps to fail, and websites to not load in Safari in macOS Catalina and iOS 13, according to Apple.

Google, Microsoft, and Mozilla all deprecated SHA-1 certificates in 2017.

Tags: Safari, SHA-1

Related Forums: iOS 13, macOS Catalina

Popular Stories

Apple Explains Why Chrome Users Should 'Switch to Safari'

Tuesday October 13, 2026 5:29 am PDT by Joe Rossignol

Apple has launched a new "Switch to Safari" marketing campaign that encourages Chrome users to switch to Safari as their web browser of choice on the Mac. "Safari is a more powerful and private browser than Chrome," says Apple. Apple has a new "Switch to Safari" page on its website that outlines more than 10 reasons that Chrome users should switch to Safari, including faster performance...

• 69 comments

RIP, MacBook Ultra

Monday October 19, 2026 9:37 am PDT by Joe Rossignol

Apple today sent out invites for an experience in Los Angeles on Wednesday, October 28, and the "Pro and tell" tagline on the invitation likely means that the rumored MacBook models with touch-enabled OLED displays will stick with MacBook Pro branding instead of the once-rumored "MacBook Ultra" name. The long-rumored "iPhone Ultra" ended up being named iPhone Duo, so speculation that Apple...

• 160 comments

Here's What Apple's Apps Look Like on the iPhone Duo

Tuesday October 20, 2026 11:12 am PDT by Juli Clover

With just three days to go until the iPhone Duo is released, Apple is getting ready for the launch. Behind the scenes, the App Store now has screenshots of Apple's built-in apps running on the Duo. We've seen some apps in marketing materials, but images of the ones we haven't seen give us an idea of what it will be like using the iPhone Duo day to day. Many apps are shown in landscape...

• 116 comments

Top Rated Comments

Sasparilla

96 months ago

Nice to see them doing this.

Planned obsolescence...smh...

For an insecure encryption algorithm? I would hope they'd deprecate it (following Google, Firefox etc.).

Score: 17 Votes (Like | Disagree)

keysofanxiety

96 months ago

Planned obsolescence...smh...

I know, it's a disgrace. Little known fact: very few websites work well on Netscape Navigator either :mad:

Score: 5 Votes (Like | Disagree)

SteveOfTheStow

96 months ago

For an insecure encryption algorithm? I would hope they'd deprecate it (following Google, Firefox etc.).

There was an implicit /s in vicviper789's post ;)

Score: 5 Votes (Like | Disagree)

darngooddesign

96 months ago

There was an implicit /s in vicviper789's post ;)

It’s impossible to tell if someone is being sincere or sarcastic on the internet; which is why we have ‘/s’.

Score: 4 Votes (Like | Disagree)

Soba

96 months ago

Planned obsolescence...smh...

I get your point and share the frustration, but it's not warranted in this case.

Encryption algorithms have shelf lives, more or less. Weaknesses are periodically discovered that make them vulnerable to cracking or workarounds, as in this case. Generally these problems cannot be fixed in the way ordinary software is patched because the problems are not specific to any vendor and are simply fundamental flaws in the encryption mechanism; the only solution is abandonment of the encryption method and moving on to safer methods.

SHA-1 is over 25 years old and has been known to have problems since at least 2005. Deprecating encryption methods that are known to be too weak or vulnerable is the right thing to do, and if anything, this move is long overdue.
[doublepost=1559832487][/doublepost]

I know, it's a disgrace. Little known fact: very few websites work well on Netscape Navigator either :mad:

I miss Netscape. ;)

I have to laugh at the 40-bit encryption we used in the late 90s (32-bit in some parts of the world). It wasn't thought overly safe even at the time, but that seems just silly, today.

Score: 4 Votes (Like | Disagree)

lunarworks

96 months ago

I miss Netscape. ;)

I have to laugh at the 40-bit encryption we used in the late 90s (32-bit in some parts of the world). It wasn't thought overly safe even at the time, but that seems just silly, today.

Remember when encryption-enabled Netscape was considered a "munition", and was barred from export from the US, so they had a plaintext-only version for the rest of the world?

Score: 2 Votes (Like | Disagree)

Read All Comments

Apple Drops Support for SHA-1 Certificates in macOS Catalina and iOS 13

Popular Stories

Apple Explains Why Chrome Users Should 'Switch to Safari'

RIP, MacBook Ultra

Here's What Apple's Apps Look Like on the iPhone Duo

Top Rated Comments

Next Article

Videos

Guides

Upcoming

Other Stories