The canl-java library hard-coded SHA1 algorithm for proxy-delegation:
https://github.com/eu-emi/canl-java/blob/master/src/main/java/eu/emi/security/authn/x509/proxy/ProxyCSRGenerator.java#L147
With modern OSes, the sha1 algorithm is banned, thus applications that depend on canl-java experience incompatibilities.
gridcf/gct#225