Generate an SHA-1 signed certificate after cutover to SHA-2
You’ve finally made the switch on your Microsoft AD CS PKI infrastructure to SHA2 (SHA256)… but there is always one.
One outlier application that won’t accept an SHA-2 certificate and needs an SHA1 certificate to keep chugging for 1 more year.
Don’t worry, you can switch your Active Directory Certificate Services PKI infrastructure back to SHA-1 for a little bit.
certutil -setreg ca\csp\CNGHashAlgorithm SHA1
restart-service certsvc
Now issue your certificate, and switch back.
certutil -setreg ca\csp\CNGHashAlgorithm SHA256
restart-service certsvc
Note that only the leaf certificate will be SHA1, your chain will still be SHA2 - if your application can’t handle that then it is out of luck.
There is a small chance that some auto-enrolled certificate ALSO got issued with an SHA1 certificate. So you can run a quick query to see all the certificates that were issued in the last hour
certutil -restrict "SubmittedWhen >= now-00:01, Disposition = 20" -view csv | ConvertFrom-Csv | fl "Request Submission Date","Requester Name","Issued Common Name"
If you were unlucky and a certificate was issued while you were in SHA1 you may want to go and renew it again.