**The error message is just misleading**

You said yourself:
>I know that AES_256_CBC isn't considered modern cryptography, so the warning about obsolete cryptography would still appear.

And that is why you get that message.

Now unfortunately the message itself is not very clearly phrased.

SHA-1 is used in several circumstances. And here the "SHA-1" refers to HMAC message authentication and not to its use inside certificates.

From the [Chromium TLS page](https://www.chromium.org/Home/chromium-security/education/tls) (Archived [here](https://archive.is/tLi3o).):
>**Message Authentication**
>
You may see:
>
*“The connection is using [cipher] with SHA1 for message authentication.”*
>
This actually means that the connection is using HMAC-SHA1 for data integrity, rather than as a certificate signing algorithm (e.g. sha1WithRSAEncryption). The HMAC construction is strong enough that it is not broken when used with SHA1 (or even MD5) as the hash function, so this is **not** currently deprecated.


**What to do**  
Enable a cipher suite on your server that Chrome likes better. Namely: Something with forward secrecy and either AES-GCM or CHACHA20_POLY1305. (The TLS page recommends `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`.)