Full threadalanfranzoni·Beyond the expiry fact, I think google does pinning for their certs. If you pin your certs you don't really care a lot whether the ca is compromised, and here it's just the ca that's got sha1 signing, not the actual cert which is sha2.View on HN