SAML SSO -> SP Certificate | Azure IdP

I have SAML SSO enabled on the FortiGate using Azure as the IdP, and it's working well.

I'm now trying to enable the SP certificate. I tested several certificates from the FortiGate certificate list, but each one fails with the error:"Signature algorithm used to sign data is not supported."

The IdP metadata shows Azure requires this signature method in SAML metadata:

<SignatureMethod Algorithm="...rsa-sha256" />

How can I generate or issue a certificate on the FortiGate that will produce RSA with SHA-256 signatures via CLI? Please help with CLI commands or steps.