We've got a offline root and issuing CA that are still running Sha1 for hashing. They're really only being used for user tokens for authentication so the SHA1 isn't a huge thing. However now I need to ...

Currently we don't have any kind of PKI. We're starting to look (again) at things such as digitally signing email and digitally signing PDF files. Obviously an internal PKI is of limited use as once ...