Thanks Tomas,

I am using the admin Guide. i have generated the keys using clientToolBox. >>ejbcaClientToolBox.sh PKCS11HSMKeyTool generate /usr/lunasa/lib/libCryptoki2_64.so secp160r1 ocsp 1.
but when i try to create certificate req using the following command, signature Hash is always with SHA1.

./ejbcaClientToolBox.sh PKCS11HSMKeyTool certreq /usr/lunasa/lib/libCryptoki2_64.so 1 ocsp

is there any parameter that can be used to change the Hash Algorithm?