Digital Signature Service release 1.7

On 23 September 2025 we plan to apply a software release to the Digital Signature Service.

We expect to apply the change at 2:00pm. There should be no service impact and you can continue to use the system as normal. You do not need to do anything in preparation for this release.

From 23 September 2025, you'll no longer be able to generate a signature using SHA-1 on Path to Live (PTL) environments.

What this means for health and social care application suppliers

After this release, the algorithm used to sign the prescription must be SHA-2 (RS256 in the documentation). Suppliers must ensure that they have not hardcoded the RS1 algorithm when creating the prescription signature, because the signature will be invalid. 

In order to create a SHA-2 signature, you must use one of the following: 

• Windows Hello
• security keys
• iOS CIS2 app
• NHS smartcards (series 8 or 9 with correct middleware)

Why we are doing this

We are removing legacy support for SHA-1 signatures on PTL environments in the interest of keeping the estate up to date.