* use the default RSA key length, instead of hardcoding 1024 (too weak) or 2048 (same as the current default).
* use SHA256 in certificates.