Correct some inconsistencies in keylen/csr_keylen. Should fix csr generation errors mentioned on ticket #2820
Default to using sha256 for a ca/cert digest algorithm, since sha1 is no longer recommended.