The percentage of sites using SHA256 certificate is tiny, and most CAs are still SHA1 based.