>> made it fallback to SHA1 when that isn't available. Note that puppet cert >> lists a much longer digest for PROD with (SHA256) at the beginning. The >> digest algorithm is not configurable so if you need to run old openssl on >> your agents then you need to issue your certs...