sign CSRs with -sha256 as sha1 default is getting weak