//  2. the server certificate in response contains no SAN. This indicates that this binary run
//     with the GODEBUG=x509ignoreCN=0 in env
//
// It increases the `sha1` counter whenever:
//  1. we get a x509.InsecureAlgorithmError with string `SHA1`
//     which indicates an error caused by an insecure SHA1 signature
//  2. the server certificate in response contains a SHA1WithRSA or ECDSAWithSHA1 signature.