how to migration certificate authority from sha1 to sha256