Trivy reports an X.509 certificate whose signature algorithm identifies SHA-1 with RSA, DSA, or ECDSA. The finding concerns the signature on the certificate, which was created by its issuer. It does not describe the algorithm of the certificate’s own public key.
SHA-1 has weaknesses in its collision resistance, a property needed for digital signatures to reliably protect the signed content. NIST recommends transitioning away from SHA-1 and restricts its use for generating new digital signatures. A certificate’s impact depends on how it is used and trusted; finding it in an image does not establish that an application uses it.
Certificates in system trust stores are checked too, including self-signed roots. Trivy does not validate certificate chains or determine whether a root is used as a trust anchor.
You can suppress selected findings using CRYPTO-0001 and optional file paths in the crypto section of .trivyignore.yaml. Specify the file with --ignorefile .trivyignore.yaml; the certificates remain in the inventory.
RSA-PSS certificate signatures are not covered by this check because Trivy does not inspect their hash parameters. A SHA-1 fingerprint or a separate use of SHA-1 elsewhere in a file is not the certificate signature checked by this rule.