prefer SHA1 over MD5 (this affects the Kerberos ciphersuites)