MS SHA-1 Support stops 14/2-2017 - impact on 802.1x validation ?

[tuenoerg]

Hi all,

MS stops the support of SHA-1 certificates soon, and I know it affects Anyconnect client.

But - will it impact customers using SHA-1 certificates in their ISE infrastructure with 802.1x (eap-tls) and the builtin supplicant on Windows operating systems too ?

Best regards

Tue

[hslai]

From my understanding of https://aka.ms/sha1, Phase 1 impacts browsers only. And, its FAQ said,

How will SHA-1 client authentication certificates be impacted?

The February 2017 update will not prevent a client using a SHA-1 signed certificate from being used in client authentication.

[csarrazi]

ISE 2.2 default self signed cert is provide with a SHA-1 cert, even for the administration page, we need to update the default certificate to SHA-2

[hslai]

CSCun17164 is an existing defect on that.