Certificate Authority certificate issued with incorrect hash algorithm

Question

Hi all,
We have a certificate authority which was migrated from Server 2003 to 2008R2, the issue is that after running this command:
certutil -setreg ca\csp\CNGHashAlgorithm sha256
to upgrade the CA to SHA256, we renewed the CA certificate but the certificate still renewed using SHA1. The cryptographic settings in the CA properties dialog box says SHA256 however the certificate is issued using SHA1. Here is the image:
Any pointers to how we can reissue CA certificate with SHA256 algorithm?
Thanks,
Ojas

Answer 1

[Puneet Singh] What i feel is that your initial key which was generated was CAPI based that might be the reason you might be facing the problem.
Try to do the things in below sequence.
certification authority’s system, you will need to run the following commands from an elevated command line window:
 certutil -setreg ca\csp\CNGHashAlgorithm SHA256
net stop certsvc
net start certsvc
Make sure you are  using a Key Storage Provider that supports SHA256 – for example the Microsoft Key Storage Provider -
and then renew the certification authority’s certificate.
 if you have the CAPI provider or you are CAPI based key  then you have to convert it to CNG key and use certutil
repair so that  it does start using the CNG key.
Puneet Singh