GitHub turned off SHA-1 in HTTPS — check your oldest box

If a build started failing this morning with a TLS handshake error and nothing in your code changed, this is why. GitHub disabled SHA-1 in HTTPS on September 15 for github.com and its partner CDNs. Anything that negotiates TLS using SHA-1 signature algorithms no longer connects. That is not your laptop — it is the 2019 CI runner nobody has rebuilt, the Docker base image pinned five years ago, and the appliance in the closet that pulls a repo on a cron.

What actually happened

GitHub announced the sunset on April 20 and ran it on schedule. The plan had two steps: a brownout on July 14 from 00:00 to 18:00 UTC, where SHA-1 was switched off temporarily so anyone still depending on it would break loudly while someone was awake to notice, then the permanent cutoff.

That cutoff landed September 15 and covers github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with Data Residency, plus partner CDNs. GitHub Enterprise Server is not affected — if you self-host, nothing changed for you today.

GitHub left a test endpoint standing. github.dev has had SHA-1 disabled for a while. If a client can load it, that client speaks modern TLS. If it hangs or throws a handshake failure, it was already broken and you just found out.

Why it matters for your business

This is a technical-debt bill arriving with a due date, and the failure mode is the annoying kind: not an error page a human reads, but a git fetch that fails inside automation at 3am. The blast radius is wherever you run old userland — a pinned node:14 or alpine:3.9 base image, a Jenkins box on an OS that went EOL, a Raspberry Pi doing deploys, a vendor appliance that phones home to a repo.

Test before you debug. Run curl -sSf https://github.dev -o /dev/null && echo ok from inside each build container and each host that talks to GitHub. That one line tells you which machines are already dead. Do it from the container, not from the host — the container ships its own OpenSSL.

Then fix the base image, not the symptom. The right repair is a newer base image or an OS upgrade. It is not disabling certificate verification, and it is not pinning an old CA bundle, which is how a small outage turns into a supply-chain problem.

Then look at what else you have pointed at old TLS. GitHub is the one with a changelog and a brownout. Your payment processor, your package registry, and your webhook receivers are all on the same industry-wide deprecation curve, and not all of them will warn you first.

Sources: GitHub Changelog — SHA-1 in HTTPS on GitHub sunset, GitHub Changelog — Sunsetting SHA-1 in HTTPS on GitHub.