I'm confused by the blurring of sha-2 on the CSR with the hash function used for the cert. The hash used in the CSR signature has nothing to do with the hash u

I'm confused by the blurring of sha-2 on the CSR with the hash function used for the cert. The hash used in the CSR signature has nothing to do with the hash used to sign the certificate. I don't know of any CA that requires a sha-2 CSR to emit a sha-2 cert; does CertSimple? I agree it would be cryptographically correct, and I bet there's a nasty vulnerability in there that'll be exposed the day SHA-1 is broken---but that day isn't today.