<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Greetings CAB Forum,</div><div class=""><br class=""></div>We have posted our SHA-1 deprecation plan here: <a href="https://support.apple.com/en-us/HT207459" class="">https://support.apple.com/en-us/HT207459</a><div class=""><br class=""></div><div class=""><b class="">Safari and WebKit ending support for SHA-1 certificates</b></div><div class="">Website operators should move to SHA-256 signed certificates as soon as possible.<br class=""><br class="">In Spring 2017, a security update to Apple’s operating systems will remove support for SHA-1 signed certificates used for Transport Layer Security (TLS) in Safari and WebKit.<br class="">This security update will remove support for all certificates that are issued from a root Certification Authority (CA) included in the operating system default trust store. All other TLS connections will continue to support SHA-1 signed certificates until late 2017. SHA-1 signed root CA certificates, enterprise-distributed SHA1 certificates, and user-installed SHA1 certificates are not affected by this change.<br class=""><br class=""></div><div class=""><b class="">What will change?</b><br class=""><br class="">With the upcoming security update, Safari displays a notification when a user navigates to a webpage that attempts to create a TLS connection using a SHA-1 signed certificate. The user will have to click to load the site. After loading, the site appears as an insecure connection in Safari.<br class="">Apps that use WebKit to connect to a site using TLS will receive an error if the site’s certificate is SHA-1 signed. Developers will need to ensure that their apps handle these errors.<br class=""><br class=""></div><div class=""><b class="">What do I need to do?</b><br class=""><br class="">Developers and website operators should move to SHA-256 signed certificates as soon as possible to prevent users from encountering warnings when connecting to their sites. There are many CA operators providing SHA256 signed certificates.</div><div class=""><br class=""></div><div class="">Regards,</div><div class="">Apple Root Certificate Program</div><div class=""><br class=""></div></body></html>