Unable to access key in HSM for sh256 signing but can for sha1 signing - signtool

Question

How can I enable access to key in HSM when signing as sha256?
When I sign as sha1 sign tool properly pulls the cert key out of the HSM but if I change to "/fd sha256" the key can't be found within the container. I'm sure signtool can access the container, but some policy must be blocking this in the sha256 case.
My Error:
SignTool Error: The specified private key container was not found.
Sha256 command:
signtool.exe sign /f mycert.crt
/csp "Luna Cryptographic Services for Microsoft Windows"
/kc mycontainer /tr http://timestamp.digicert.com /td sha256
/fd sha256 signed-file.exe
Sha256 command, which works:
signtool.exe sign /f mycert.crt
/csp "Luna Cryptographic Services for Microsoft Windows"
/kc mycontainer /tr http://timestamp.digicert.com /td sha256
/fd sha1 signed-file.exe
/debug and /v options offer no additional information.
If I use makecert to generate a new self signed cert it the command generates a container which CSP can use for sha1 or sha256. Luna's CSP\keymap.exe tool allows me to manage containers and keys. I can create new ones for signing or exchange and then associate keys with them.
Generate Cert and upload kes to HSM
# Create Cert and store keys on HSM in a container called "noi1-501706key"
makecert -sk noi1-501706key -sp "Luna Cryptographic Services for Microsoft Windows" -r
-n "CN=noi1- 501706" -ss TestStore noi1-501706.cer
# make self signed
Cert2Spc noi1-501706.cer noi1-501706.spc
Use Program Files\Safenet\Luna Client\CSP\keymap
create new container
associate pub/private with new container
using new container sha1 works and sha256 fails. All attempts to view the two containers show them as identical.

Answer 1

Check the KeyContainer,public and private key objects labels (cmu.exe list or keymap.exe Browse Objects).Public and private key labels should be in following format:
Container name: ContainerName
Private key: S-ContainerName
Public key: S-ContainerName
Use cmu.exe setattribute to change the label.

Answer 2

According to the chapter 7 "Integrating Microsoft HCK (Windows Server 2012) with Luna HSM" I noticed the following which makes me think the creation of the CSR via an HSM tool on linux instead of makecert we are blocked from KSP/CNG.
So, we will never get Luna client to find the key for the cert. We need to either get a new cert or migrate to a new HSM and get a new cert. This is because AWS CloudHSM Classic uses hardware configured to block export of keys regardless of policy. No change to escrow the keys here.
In order to integrate the Luna SA Hardware Security Module with Microsoft HCK, the Luna CSP “Luna Cryptographic Services for Microsoft Windows” must be used to generate the certificate. The
certificate must be signed and the signer certificate must be present in the “Trusted Root Certificate Authority”. You can use the CA signed certificate of self-signed certificate both.