Please support RFC 7093 Section 2(1) for subjectKeyIdentifier=hash

https://community.letsencrypt.org/t/enabling-sha256-subject-key-identifiers-for-end-entity-certificates/211453 https://github.com/golang/go/issues/71746 https://docs.rs/rcgen/latest/rcgen/enum.KeyIdMethod.html

https://www.rfc-editor.org/rfc/rfc7093 :

1. The keyIdentifier is composed of the leftmost 160-bits of the SHA-256 hash of the value of the BIT STRING subjectPublicKey (excluding the tag, length, and number of unused bits).

Currently openssl uses the old RFC5280 method of using SHA1, this is now not compatible with what other languages and tools are doing, and breaks catastrophically when building a FIPS provider without SHA1 marked as fips=yes, because SHA1 is fetched with default property query string.

Please consider upgrading existing subjectkeyIdentifier=hash to be SHA-256/160 based. Optionally for backwards compatability consider creating =sha1 option to be SHA-1, or I guess reuse the "old" option again, which used to be MD5 prior to SHA1 usage (?! this predates my time).

Also please consider to fetch SHA1 with property query string of "?fips=yes" or "-fips".