Use SHA-1 instead of SHA-256.

Apparently most OCSP sites do not support SHA-256.