While is was still possible to generate certificates with
default_md=sha1, those certificates were not usable in modern
software. Older certificates can still be managed without
issue after changing this setting.