The claim that CAs have been sitting on SHA-1 and not migrating to SHA-2 is not entirely accurate, at least in my experience with DigiCert.

Consequently, people I know there have told me that 25% of all SHA-2 certs expiring in 2017 have been issued by DigiCert, well beyond their market share. DigiCert has migrated all but a couple hundred customer certificates expiring in 2017 onto SHA-2, and those should be moved soon.

As for CAs in general, much of the blame lies not with CAs but with the lack of SHA-2 compatibility in certain devices and software.

For its part, today, DigiCert released a new, free tool that makes it easy for sys admins to identify all SHA-1 certs in their networks, determine validity periods and how future Chrome releases will treat these certs, and help admins map out a path toward SHA-1 sunsetting and SHA-2 migration.

DigiCert will also replace any SHA-1 certs – for current customers and non-customers alike – for free. They will match the existing SHA-1 term for a free upgrade to SHA-2 through the end of the licensing period. Here’s a link from a Dark Reading article:

http://www.darkreading.com/endpoint/authentication/digicert-....