Also, reflecting on the installation of the sha2 module, it occurs to me that short of the CentOS repo package already having sha2 compiled in, the best course of action is probably to compile only the sha2 module and use it with the CentOS package --- including the module in the slapd configuration seems to be the extent of integration, so that should work, no? If so, I think this would be the best option.
This has been tested and works. It requires compilation of the full OpenLDAP source in order to compile and install the sha2 module, but that's easy and of course you skip the "make install" step. After that, install the hand-built sha2 module, add it to your configuration and it works fine.