diff -Naru easy-rsa/easy-rsa/1.0/openssl.cnf easy-rsa.new/easy-rsa/1.0/openssl.cnf
--- easy-rsa/easy-rsa/1.0/openssl.cnf	2013-01-29 16:35:08.146005453 +0000
+++ easy-rsa.new/easy-rsa/1.0/openssl.cnf	2013-01-29 16:39:26.893385144 +0000
@@ -54,7 +54,7 @@
 
 default_days	= 3650			# how long to certify for
 default_crl_days= 30			# how long before next CRL
-default_md	= md5			# which md to use.
+default_md	= sha256		# which md to use.
 preserve	= no			# keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -87,6 +87,7 @@
 [ req ]
 default_bits		= $ENV::KEY_SIZE
 default_keyfile 	= privkey.pem
+default_md		= sha256
 distinguished_name	= req_distinguished_name
 attributes		= req_attributes
 x509_extensions	= v3_ca	# The extentions to add to the self signed cert
diff -Naru easy-rsa/easy-rsa/2.0/openssl-0.9.6.cnf easy-rsa.new/easy-rsa/2.0/openssl-0.9.6.cnf
--- easy-rsa/easy-rsa/2.0/openssl-0.9.6.cnf	2013-01-29 16:35:08.298016249 +0000
+++ easy-rsa.new/easy-rsa/2.0/openssl-0.9.6.cnf	2013-01-29 16:38:46.447511741 +0000
@@ -56,7 +56,7 @@
 
 default_days	= 3650			# how long to certify for
 default_crl_days= 30			# how long before next CRL
-default_md	= md5			# which md to use.
+default_md	= sha256		# which md to use.
 preserve	= no			# keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -89,6 +89,7 @@
 [ req ]
 default_bits		= $ENV::KEY_SIZE
 default_keyfile 	= privkey.pem
+default_md		= sha256
 distinguished_name	= req_distinguished_name
 attributes		= req_attributes
 x509_extensions	= v3_ca	# The extentions to add to the self signed cert
diff -Naru easy-rsa/easy-rsa/2.0/openssl-0.9.8.cnf easy-rsa.new/easy-rsa/2.0/openssl-0.9.8.cnf
--- easy-rsa/easy-rsa/2.0/openssl-0.9.8.cnf	2013-01-29 16:35:08.300016391 +0000
+++ easy-rsa.new/easy-rsa/2.0/openssl-0.9.8.cnf	2013-01-29 16:39:02.191630237 +0000
@@ -59,7 +59,7 @@
 
 default_days	= 3650			# how long to certify for
 default_crl_days= 30			# how long before next CRL
-default_md	= md5			# which md to use.
+default_md	= sha256		# which md to use.
 preserve	= no			# keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -94,6 +94,7 @@
 [ req ]
 default_bits		= $ENV::KEY_SIZE
 default_keyfile 	= privkey.pem
+default_md		= sha256
 distinguished_name	= req_distinguished_name
 attributes		= req_attributes
 x509_extensions	= v3_ca	# The extentions to add to the self signed cert
diff -Naru easy-rsa/easy-rsa/2.0/openssl-1.0.0.cnf easy-rsa.new/easy-rsa/2.0/openssl-1.0.0.cnf
--- easy-rsa/easy-rsa/2.0/openssl-1.0.0.cnf	2013-01-29 16:35:08.302016533 +0000
+++ easy-rsa.new/easy-rsa/2.0/openssl-1.0.0.cnf	2013-01-29 16:38:22.689823979 +0000
@@ -54,7 +54,7 @@
 
 default_days	= 3650			# how long to certify for
 default_crl_days= 30			# how long before next CRL
-default_md	= md5			# use public key default MD
+default_md	= sha256		# use public key default MD
 preserve	= no			# keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -89,6 +89,7 @@
 [ req ]
 default_bits		= $ENV::KEY_SIZE
 default_keyfile 	= privkey.pem
+default_md		= sha256
 distinguished_name	= req_distinguished_name
 attributes		= req_attributes
 x509_extensions	= v3_ca	# The extentions to add to the self signed cert
diff -Naru easy-rsa/easy-rsa/2.0/pkitool easy-rsa.new/easy-rsa/2.0/pkitool
--- easy-rsa/easy-rsa/2.0/pkitool	2013-01-29 16:35:08.304016675 +0000
+++ easy-rsa.new/easy-rsa/2.0/pkitool	2013-01-29 17:18:51.638847417 +0000
@@ -322,7 +322,7 @@
 
     # Build root CA
     if [ $DO_ROOT -eq 1 ]; then
-	$OPENSSL req $BATCH -days $CA_EXPIRE $NODES_REQ -new -newkey rsa:$KEY_SIZE -sha1 \
+	$OPENSSL req $BATCH -days $CA_EXPIRE $NODES_REQ -new -newkey rsa:$KEY_SIZE \
 	    -x509 -keyout "$CA.key" -out "$CA.crt" -config "$KEY_CONFIG" && \
 	    chmod 0600 "$CA.key"
     else        
@@ -356,7 +356,7 @@
 	( [ $DO_REQ -eq 0 ] || $OPENSSL req $BATCH -days $KEY_EXPIRE $NODES_REQ -new -newkey rsa:$KEY_SIZE \
 	        -keyout "$FN.key" -out "$FN.csr" $REQ_EXT -config "$KEY_CONFIG" $PKCS11_ARGS ) && \
 	    ( [ $DO_CA -eq 0 ]  || $OPENSSL ca $BATCH -days $KEY_EXPIRE -out "$FN.crt" \
-	        -in "$FN.csr" $CA_EXT -md sha1 -config "$KEY_CONFIG" ) && \
+	        -in "$FN.csr" $CA_EXT -config "$KEY_CONFIG" ) && \
 	    ( [ $DO_P12 -eq 0 ] || $OPENSSL pkcs12 -export -inkey "$FN.key" \
 	        -in "$FN.crt" -certfile "$CA.crt" -out "$FN.p12" $NODES_P12 ) && \
 	    ( [ $DO_CA -eq 0 -o $DO_P11 -eq 1 ]  || chmod 0600 "$FN.key" ) && \
