GitHub disabled SHA-1 in HTTPS — old clients can't connect now
The switch flipped Sept 15 for github.com, its CDNs and Enterprise Cloud. Modern stacks are fine; old git builds, stale CI images and legacy scripts aren't.
Copy markdown
What flipped, and where
GitHub removed SHA-1 from HTTPS on github.com, its CDNs, and GitHub Enterprise Cloud, including Data Residency, as of Sept 15. GitHub Enterprise Server is untouched, so self-hosted installs keep working.
Who actually breaks
GitHub names three surfaces: browsers, API clients, and git over HTTPS. In practice it's the stragglers that fail the TLS handshake now — very old git or OpenSSL builds, unpatched CI base images, and legacy automation — on clone, fetch, push, and API calls.
The two-minute check
Open github.dev in your browser; it's had SHA-1 off for months, so if it loads you're clear there. For git and scripts, move to a recent git with a current OS TLS backend and a modern HTTP library, then rebuild stale CI images. The July 14 brownout was the dry run — most modern stacks already passed it.
Also on GitHub this week
Two smaller changes landed Sept 15: Copilot can now suggest custom property definitions for your repos, and admins can enforce Advanced Security configurations across an entire org instead of repo by repo.