VMware recommends the certificate authorities to generate certificate using SHA256 and also in SSO LB document they mentioned not to use SHA 1 signature algorithm for SSL certificate. Pls find the below steps to upgrade the CA to SHA256.

Before doing any changes to the CA take the backup of the CA repository and SUB CAs

Certuil -backup \\share\backup

Certuil -backup \\Share\subbackup

Upgrade Certification Authority to SHA256

Open the Windows Powershell.

Enter the command:

certutil -setreg ca\csp\CNGHashAlgorithm SHA256

Restart the service.

After the change CA will issue now SHA256 as Hash Algorithm and also we can renew CA to use SHA256.

Reference :

https://blogs.technet.microsoft.com/heyscriptingguy/2016/02/18/migrate-windows-ca-from-csp-to-ksp-and-from-sha-1-to-sha-256-part-4/?wt.mc_id=WW_CE_WS_OO_SCL_TW&Ocid=C+E%20Social%20FY16_Social_TW_windowsserver_20160220_372280964

http://blogs.technet.com/b/askds/archive/2015/10/26/sha1-key-migration-to-sha256-for-a-two-tier-pki-hierarchy.aspx