GitHub confirms SHA-1 in HTTPS sunset for github.com and Enterprise Cloud
securitydeprecationengineer
announcement
GitHub has completed the planned deprecation of SHA-1 in HTTPS across its services. This action affects github.com, GitHub Enterprise Cloud, and associated partner CDNs, including those with Data Residency. The sunset, previously announced for September 15th, 2026, has been fully implemented, enhancing security by moving away from the weaker SHA-1 algorithm. GitHub Enterprise Server installations remain unaffected by this change.
Notes (1) ›
- SHA-1 in HTTPS sunset completed for GitHub.com and Enterprise Cloud
GitHub has disabled SHA-1 in HTTPS for github.com and partner CDNs, including GitHub Enterprise Cloud and GitHub Enterprise Cloud with Data Residency, as per its planned schedule. This change does not affect GitHub Enterprise Server.
Read the original announcement →
https://github.blog/changelog/2026-09-15-sha-1-in-https-on-github-sunset
Related releases
- Enterprise Admins Can Now Enforce GitHub Advanced Security Configurations GitHub Changelog ·
- GitHub Copilot suggests custom repository property definitions GitHub Changelog ·
- GitHub Profiles Now Show Highest Achievement Badge Tier GitHub Changelog ·
- GitHub Copilot adds tiers for cost and quality in auto model selection GitHub Changelog ·
- GitHub Copilot usage metrics now include VS Code Agents activity GitHub Changelog ·
- GitHub Copilot Code Review Gains Auto-Resolution, Smart Commits, and Deeper Analysis GitHub Changelog ·