To create a certificate signing request (CSR) with gpgsm of GnuPG 2.1.x you can
use the parameter 'hash-algo'. See [1] (last entry).
The default value of 'hash-algo' is still 'sha1'. It should be set to 'sha256'.
Is there a reason why it is still 'sha1'?
BTW: This is a customer request.