Your description is an inaccurate representation of the API then. OpenSSL has had SHA-256 support by default since the initial 0.9.8 release.
Use of the EVP lookup functions is dependent upon calling OpenSSL_add_all_algorithms() or populating the tables by other means. What (if any) algorithms are available without doing so is not defined anywhere in the API. There is no guarantee that SHA-1 or MD5 would be available either.
Edit: If you know of programs linked against early openssl 0.9.8 that are having problems you should file bugs, because they are reliant upon undefined behavior in the OpenSSL API. This is true even when linked against OpenSSL 1.0.1.
Edit 2: Not that this makes the problem any less real, but the problem is the broken applications, not the version of OpenSSL they linked to. Being version 0.9.8o is not necessary for SHA-256 certificate support for programs correctly using the OpenSSL API.
Comments
Your description is an inaccurate representation of the API then. OpenSSL has had SHA-256 support by default since the initial 0.9.8 release.
Use of the EVP lookup functions is dependent upon calling OpenSSL_add_all_algorithms() or populating the tables by other means. What (if any) algorithms are available without doing so is not defined anywhere in the API. There is no guarantee that SHA-1 or MD5 would be available either.
Edit: If you know of programs linked against early openssl 0.9.8 that are having problems you should file bugs, because they are reliant upon undefined behavior in the OpenSSL API. This is true even when linked against OpenSSL 1.0.1.
Edit 2: Not that this makes the problem any less real, but the problem is the broken applications, not the version of OpenSSL they linked to. Being version 0.9.8o is not necessary for SHA-256 certificate support for programs correctly using the OpenSSL API.