Signature Algorithm Findings

Each certificate is signed by its issuer with a signature algorithm, such as sha256WithRSAEncryption or ecdsa-with-SHA384. A weak algorithm lets a certificate be forged.

All three findings have the same fix: reissue the certificate with a SHA-256 or stronger signature. Every public CA issues SHA-256 or stronger by default, so these findings usually come from an internal CA, a self-signed certificate, or a very old certificate.

To confirm, install the reissued certificate and click Check Now on the monitor's page. openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text | grep "Signature Algorithm" shows the served certificate's algorithm.

CERT_SIG01: Signature algorithm not recognized

Key: CERT_SIG01 · Label: Unknown Sig Algorithm · Severity: Warning · Can be dismissed: No

What it means: the certificate's signature algorithm couldn't be identified.

Why it matters: clients that don't recognize the algorithm can't verify the certificate.

How to fix it: reissue the certificate with a SHA-256 or stronger signature.

CERT_SIG02: Weak signature algorithm

Key: CERT_SIG02 · Label: Weak Sig Algorithm · Severity: Error · Can be dismissed: No

What it means: the certificate is signed with a weak algorithm, such as SHA-1, that's no longer considered secure.

Why it matters: browsers and current TLS libraries reject SHA-1 signatures on certificates.

How to fix it: reissue the certificate with a SHA-256 or stronger signature.

CERT_SIG03: Insecure signature algorithm

Key: CERT_SIG03 · Label: Insecure Sig Algorithm · Severity: Error · Can be dismissed: No

What it means: the certificate is signed with an insecure algorithm, such as MD5.

Why it matters: these signatures can be forged in practice, and clients reject them.

How to fix it: reissue the certificate with a SHA-256 or stronger signature.