Verisign sha1 deprecation to sha2

you can use the old csr and key

I think you will need to regenerate the csr with the "-sha256" option with openssl.

With newer versions, such as v11.5.1, sha256 is the default, so you can simply generate a new csr from the Configuration Utility.