Digital Signature Service release 1.7

On 8 October 2025 we plan to apply a software release to the Digital Signature Service.

We expect to apply the change at 2:00pm. There should be no service impact and you can continue to use the system as normal. You do not need to do anything in preparation for this release.

From 8 October 2025, you'll no longer be able to generate a signature using SHA-1 on Live.

What this means for health and social care application suppliers

After this release, the algorithm used to sign the prescription must be SHA-2 (RS256 in the documentation). Suppliers must make sure that they have not hardcoded the RS1 algorithm when creating the prescription signature, because the signature will be invalid. 

In order to create a SHA-2 signature, you must use one of the following: 

• Windows Hello
• security keys
• iOS CIS2 app
• NHS smartcards (series 8 or 9 with the correct middleware)

Why we are doing this

We are removing legacy support for SHA-1 signatures in the interest of keeping the estate up to date.