The news is that the hashing function SHA1 is on the way out, after Microsoft and nowGoogle said that they will soon start penalising sites that use SHA1 certificates that expire during 2016 and after has caused some panic.
This is a major policy change that requires immediate action—according to SSL Pulse, only 15% sites use SHA256 certificates in September 2014.
Before this most recent development, the advice was very simple: don’t use SHA1 certificates past 2016. Google’s decision complicates things: now it’s no longer safe to use SHA1 (with Google Chrome) even during 2016. For some sites there won’t be a satisfactory outcome no matter what they do: if they want to maintain an error-free presence with Chrome they might need to cut off some older clients.
