x509 format should default to SHA256 + adds hash parameter so user can override this