I don't think it matters whether you use SHA1 or SHA256 on your CSR - a CA can issue you a SHA256 certificate regardless. Better to use SHA256 on the CSR, of course, but not worth worrying about.