Are there really CAs that copy the hash used for the CSR to the hash used for the cert? If not, the hash used in the CSR has nothing to do with Chrome warnings (as the browser will never see it).