Vulnerabity SHA-1-based Signature

[leyakhath muhammed]

Hi,

     How to fix Vulnerability- SHA-1-based Signature in TLS/SSL Server X.509 Certificate in 2960S

The SHA-1 hashing algorithm has known weaknesses that expose it to collision attacks, which may allow an attacker to generate additional X.509 digital certificates with the same signature as an original.

Thanks

[Georg Pauwen]

Hello,

to my best knowledge as of now, there is no alternative yet other than to use a higher modulus (4096). Which means the below is the best you do:

crypto key generate rsa modulus 4096
ip ssh version 2
ip ssh dh min size 4096