Previously, sha-1 signatures in certificates was disabled by default, except for certificates issued by imported roots. Chrome had a similar policy, but this was removed in 71 [0]. Telemetry [1] indicates that some users do still encounter sha-1 signatures at a fraction of the rate of overall certificate errors, so forbidding all sha-1 signatures should have minimal compatibility impact.

[0] https://chromeenterprise.google/policies/#EnableSha1ForLocalAnchors
[1] https://mzl.la/3kg5J4j

Previously [0], support for SHA1 signatures in certificates was disabled by
default, except for certificates issued by imported roots. Chrome had a similar
policy, but this was removed in 71 [1]. Telemetry [2] indicates that some users
do still encounter SHA1 signatures at a fraction of the rate of overall
certificate errors, so forbidding all SHA1 signatures should have minimal
compatibility impact.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1302140
[1] https://chromeenterprise.google/policies/#EnableSha1ForLocalAnchors
[2] https://mzl.la/3kg5J4j

Backed out changeset 8ef044a6a1fe (Bug 1766687) for causing bustage in NSSCertDBTrustDomain.cpp

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&collapsedPushes=842382&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=8ef044a6a1fe5ec51270bf5cb4f13c199bab3e7e&searchStr=linux%2Cx64%2Cdebug%2Cbuild-linux64-base-toolchains%2Fdebug%2Cbb

Log: https://treeherder.mozilla.org/logviewer?job_id=379823070&repo=autoland&lineNumber=22684

Backout: https://hg.mozilla.org/integration/autoland/rev/e91ede345c921b7d8c91caf6a4389323163eaac6

https://hg.mozilla.org/mozilla-central/rev/a4a8545b202f

Release Note Request (optional, but appreciated)
[Why is this notable]: Users previously had the option of enabling SHA-1 support in certificate signatures, which is not secure, but this change removes that option.
[Affects Firefox for Android]: yes
[Suggested wording]: Removed configuration option to allow SHA-1 signatures in certificates. SHA-1 signatures in certificates, long since determined to no longer be secure enough, are now not supported.
[Links (documentation, blog post, etc)]:

Note added to 103 nightly notes