With SHA1 certs being deprecated by major browsers it seems wise to get a SHA2 signed cert. But in doing so you will be locking out IE6 users. While for most people this won't be an issue in some cases it may lock out significant users.
Looking at the SSL handshake the client sends details of what it supports.
So in theory a server could send a certificate that the client will support. Newer browsers would get a SHA2 signed one and older ones SHA1.
However it doesn't look like there are any ways do do this with nginx configuration. While you can set versions of cyphers and protocols you can't have any logic to determine how to behave with different client configurations.
Ia there a way to server a different certificate depending on what the client supports?