SHA2 Certificate Migration

I never received a confident answer one way or the other, but I've had no problems with creating the CSR within the GUI and having it singed with SHA-2. There is no difference in the way that the keys are generated from what I can tell. If you run certutil within Windows or examine the CSR attributes you will see a SHA-1 signing algorithm. However, as long as your CA signs with SHA-2 it will update accordingly. The other solution is to create the CSR using openssl, but I haven't deemed that necessary. Make sure you update your certificate chains as well :)