GitHub Retires SHA-1 for HTTPS: What Proxy-Dependent Teams Should Test Now

GitHub announced on September 15, 2026 that it had disabled SHA-1 in HTTPS for GitHub.com and partner CDNs, including GitHub Enterprise Cloud and its data-residency service. GitHub Enterprise Server is unaffected. This is a transport-compatibility change, not a change to Git commit identifiers.

Most current browsers, Git clients and TLS libraries already support modern certificate signatures. Failures are more likely to appear in old runtime images, obsolete trust stores, TLS-inspecting gateways or proxy appliances that substitute their own certificate chain. Teams using proxies for CI, dependency retrieval, data collection or repository automation should test the complete path rather than assuming a direct browser check represents every workload.

What changed—and what did not

The retirement concerns SHA-1 on the HTTPS connection to GitHub-hosted services. It does not mean repositories suddenly stopped using SHA-1 object names, nor does it require rewriting Git history. A useful incident ticket should say whether the failure occurred during DNS, proxy authentication, CONNECT, TLS validation, redirect handling or the Git HTTP operation.

Record the client version, TLS backend, trust-store build, proxy route alias, destination hostname, address family, negotiated TLS version, certificate signature algorithm, issuer fingerprint, HTTP status and failure phase. Hash or redact credentials, tokens, cookies and certificate details that could identify private infrastructure.

Run a direct and proxied matrix

Test the same owned or authorized repository from:

• a direct connection;
• each production HTTP or HTTPS proxy gateway;
• each SOCKS5 route used by automation;
• IPv4 and IPv6 paths when both are purchased;
• a fresh connection and a reused connection;
• current and oldest-supported client images.

Keep the repository, command and timeout constant. A direct success plus a proxied TLS failure points toward the gateway, its interception chain or the proxied client's trust configuration—not GitHub availability in general.

Separate CONNECT from TLS validation

For an HTTPS proxy, first confirm that proxy authentication succeeds and the CONNECT tunnel reaches the intended hostname and port. Then inspect the certificate chain presented inside the tunnel. If the issuer differs between direct and proxied tests, document that the route performs TLS interception and verify that this behavior is authorized.

Use the HTTPS proxy TLS chain audit to compare leaf, intermediate and root behavior. The TLS interception audit helps distinguish an approved inspection gateway from an unexpected certificate substitution.

Test the operations that matter

A homepage request is only a smoke test. Exercise representative read-only operations first:

1. resolve and connect to the required GitHub hostname;
2. complete proxy authentication and TLS negotiation;
3. fetch a small authorized repository or query a read-only remote reference;
4. download one release asset or dependency from the CDN path your workflow uses;
5. repeat through a reused connection and after DNS cache expiry;
6. only after reads pass, test an authorized write in a non-production repository.

Validate every redirect destination. Do not broaden proxy allowlists based on an error page; capture the actual authorized hostname set from a successful baseline.

Classify common failures

Do not disable certificate verification to make a test pass. That hides the cause and creates a credential-exposure risk.

Define a safe acceptance gate

Approve a client and route only when the direct and proxied paths use an accepted TLS version, validate a modern chain, reach all required authorized hosts, preserve redirects correctly and complete the real read workflow without insecure overrides. Keep results separated by client image and gateway; a global average can hide one outdated region.

If a legacy client fails, prefer updating the runtime, TLS library and trust store. If an authorized inspection appliance issues an obsolete chain, replace or reconfigure the appliance. Temporary bypasses should be narrowly scoped, time-limited and reviewed by the security owner.

Release checklist

• Confirm the failure concerns HTTPS transport, not Git object identifiers.
• Test direct, HTTP proxy and SOCKS5 paths separately.
• Include the oldest supported CI or collector image.
• Record TLS backend, trust-store build and negotiated protocol.
• Compare direct and proxied certificate issuers.
• Test repository metadata and required CDN assets.
• Verify redirects without widening allowlists blindly.
• Keep certificate verification enabled.
• Remove credentials and raw tokens from logs.
• Retest every production gateway before closing the incident.

FAQ

Does this require converting existing repositories away from SHA-1?

No. The announced change is about SHA-1 in HTTPS, not the identifiers already present in Git history.

Why can a browser work while Git fails?

They may use different TLS libraries, trust stores, proxy settings and certificate-interception policies. Test the exact client image that performs the workload.

Is changing proxy providers the first fix?

Not usually. First identify whether the failure belongs to the client, trust store, gateway fleet, interception chain, hostname policy or route. Change providers only when route evidence justifies it.

Can certificate verification be disabled temporarily?

That is not a safe diagnostic shortcut for authenticated Git traffic. Capture the chain and repair the trust or appliance configuration instead.

Compliance note

Test only repositories, assets and proxy routes you own or are authorized to use. Respect GitHub access controls, organizational inspection policy, rate limits and privacy requirements. Never expose credentials, repository secrets or private certificate material in public logs.