Analysis
GitHub Disabled SHA-1 in HTTPS. Your Repositories Did Not Change.
GitHub has removed SHA-1 from HTTPS connections to GitHub.com. The change is easy to misread because Git also uses SHA-1 to identify objects. These are separate systems. Your commit hashes did not change.
This retirement concerns the HTTPS/TLS connection used by clients. Git repositories, object storage, and commit IDs are not being rewritten.
The vulnerable dependency may not be Git
A current Git binary can still fail if it delegates HTTPS to an old operating-system library. Command-line tools may use OpenSSL, Secure Transport, Schannel, or another TLS backend. IDEs, package managers, build appliances, and embedded systems can carry their own libraries. The version printed by git --version is only one piece of the path.
The systems most likely to break are old but quiet: a forgotten deployment host, an appliance fetching configuration, a legacy container image, or an internal mirror that nobody has rebuilt because it still works.
Test the real path, not a synthetic inventory
I would search logs and egress records for traffic to GitHub, then test from the actual runtime identities and images. A successful browser visit from an administrator’s laptop proves nothing about a CI runner or a ten-year-old server.
For HTTPS Git operations, start with a read-only query from the affected runtime. For APIs and release downloads, exercise the application that owns the request. Replace unsupported operating systems or libraries; weakening a proxy to restore SHA-1 only relocates the problem.
Start with a read-only request from the failing runtime
Run this with the Git executable used by the failing job, inside the same runner or container where practical:
git --version
git ls-remote https://github.com/git/git.git HEADGit documents ls-remote as a reference query. This example contacts a public repository and should print a commit identifier followed by HEAD. It does not clone the repository, update a branch, or push anything. The command was checked from this publication’s development environment; that does not establish compatibility on an old runner.
A successful response establishes that this client can reach and query that public endpoint through its configured network path. It does not test a private repository’s permissions, Git LFS, release-download CDNs, or the TLS library embedded in a different application. URL-rewrite and proxy settings can also change the path actually used.
| Observed result | Next step |
|---|---|
| DNS lookup or connection timeout | Check name resolution, routing and the proxy before attributing the failure to TLS algorithms. |
| Certificate verification error | Check the system clock, trust store and any TLS-inspecting proxy. Do not disable certificate verification. |
| TLS handshake failure | Inspect the client’s TLS backend and proxy compatibility. The message alone does not prove SHA-1 is the cause. |
| Public query works; private operation fails | Check the failing operation’s credential, SSO authorization, repository access and endpoint. Avoid treating every failure as a transport problem. |
If normal output is insufficient, collect diagnostic logging only in a controlled environment. Inspect it before sharing: headers, URLs, proxy details and repository names can expose information even when a tool redacts common credential fields. Never put a token in the command’s URL to make a test convenient.
After upgrading the affected client or runtime, repeat the original read operation under its service identity. Keep the public query as a comparison, not a replacement for that final check.
SSH is not an automatic remediation
Switching a remote from HTTPS to SSH may bypass this specific TLS dependency, but it changes credentials, host-key management, firewall rules, and audit behavior. That can be a valid migration, not a drop-in fix.
GitHub Enterprise Server is not part of GitHub.com’s change, so administrators of private instances must follow their own server version and TLS configuration. The distinction matters when an organization uses both endpoints.
The useful lesson is mundane: cryptographic retirements expose hidden clients. Inventory the complete connection stack before the deadline does it for you.