We've got a offline root and issuing CA that are still running Sha1 for hashing. They're really only being used for user tokens for authentication so the SHA1 isn't a huge thing. However now I need to ...