Exchange CSP/CNG SSL issue reminder

Ok, after a few hours... here we go:

Exchange 2013 will only make a CSR in SHA1, our CA will only accept in SHA2.
IIS/Certificate manager will generate a CSR in SHA2, but only in CNG not legacy format. (Legacy again is sha1)
Exchange won't use CNG (MS RSA Key) for ECP or OWA.

I spent ages trying to generate the right CSR, and in the end made it with Certificate manager, it all seemed to go through.
Imported it into the server, reset exchange to use it, and restarted IIS.

Everything seemed to work! Went to log into ECP, got web page, got right cert. Entered username and password, and it looped to enter username and password.
OWA was the same. Outlook wouldn't talk to exchange.

Oh Shit.
Swapping the certs back (thank you for exchange managemant powershell...) and it all worked.
Must be the cert. But everything seems to be correct.

After digging I found that the CSR from IIS/Certificate manager is CNG, and mapped to the provider Microsoft Software Key Storage Provider. Exchange wants CryptoAPI  (CSP), which can be invoked by using MS RSA Schannel. But you can't generate a CSR with this.

Finally, I found one post, just one, with an answer that worked, given I'd already purchased and now generated the cert:

OpenSSL. Seriously.

Install the windows OpenSSL system.
Export the certificate from certificate manager with the private key into a PFX.
Delete the certificate from the manager

Run openssl on it:
openssl pkcs12 -in OrginalCNG.pfx -out temp.pem
openssl pkcs12 -export -in temp.pem -out CSPCert.pfx

Then import it back in, in my case, I imported it directly into Exchange ECP.
Allocate it to the IIS/SMTP/etc systems.
Restart IIS (iisreset is the easiest).
And it all worked.

Maybe this will help someone, probably will help me again in the future.