<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Finden SHA1-collisions requires 2**63 tries (may be a bit less). Faking a certificate this way is quite expensive, there are cheaper ways.</div><div><br></div>No you do not be worried, because the security value of those commercial certificates ist near zero anyway. GoDaddy have been insuniated that they have been hacked in the past. The question is why to pay for a certificate of low value, when you can get the same product elsewhere for free, e.g. Startssl.<div><br></div><div>- Rainer</div><div><br><div><div>Am 11.01.2014 um 15:02 schrieb Ahmad Bilal <<a href="mailto:ahmadbilal200854@gmail.com">ahmadbilal200854@gmail.com</a>>:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">I have a question. I recently bought a certificate from godaddy, and during the installation I chose SHA-2, but the Certificate Signing Request in raw form has SHA-1 written on it, and not SHA-2. Should I be worried?<br>
<br><br clear="all"><div><br></div>-- <br><div dir="ltr"><i><b><font face="arial, helvetica, sans-serif">Ahmad Bilal</font></b></i><div><br></div></div>
</div>
_______________________________________________<br>Ach mailing list<br><a href="mailto:Ach@lists.cert.at">Ach@lists.cert.at</a><br><a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br></blockquote></div><br></div></body></html>