Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp signed SSL certificates throw warning in Chrome

Spencer | Last updated: Jun 10, 2015 07:28PM UTC

When burp generates CA-signed per-host certificates, Google Chrome marks these sites as having "Weak Security configuration (SHA-1 signatures), so your connections may not be private. Screenshot: http://i.imgur.com/B5XcMF9.png It looks like Chrome is actively trying to sunset SHA-1 (https://blog.filippo.io/the-unofficial-chrome-sha1-faq/) So, I'm guessing this message can be removed if Burp signed the per host certificates with sha-256?

PortSwigger Agent | Last updated: Jun 11, 2015 08:03AM UTC

Thanks for this report. We're aware of the decision by Chrome to show warnings for SHA1-signed certificates. The current version of Burp Suite Pro uses SHA-256 to sign its certificates. You can use the function at Proxy / Options / Proxy Listeners / Regenerate CA certificate to force Burp to regenerate its CA certificate. You'll need to restart Burp and install the new certificate in your browser. The update to the signing algorithm will be applied to the free edition of Burp at the next major release.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.