[backend] always use sha256 for openssl sign