Description of problem:
openssl currently employs SHA256 for signing certificates by default. For larger key sizes, it would be better to choose a stronger hash algorithm  instead, as long as the user doesn't request some specific algorithm. See "Recommendation for Key Management," NIST Special Publication 800-57 Part 1 Rev. 3, 07/2012:

By default, unless the user requests otherwise,
use SHA-256 for RSA bits <= 3072
use SHA-384 for 3072 < RSA bits <= 7680
use SHA-512 for 7680 < RSA bits

See also bug 1062444 and bug 1062325.

Version-Release number of selected component (if applicable):
openssl-1.0.1e-39.fc21.i686

How reproducible:
always

Steps to Reproduce:
1. cd /etc/pki/tls/certs
2. make KEYLEN=7680 test.pem
3. openssl x509 -in test.pem -text | grep Signature

Actual results:
    Signature Algorithm: sha256WithRSAEncryption

Expected results:
    Signature Algorithm: sha384WithRSAEncryption