download page shows sha256 hash for sha1 hash (the wrong one at that!)
The supposed sha1 hash for the gpl-licenced version is the sha256 hash for the apache-licenced version.
Thank you for pointing our attention to this mistake.
We will work on it.
Mbed TLS Team member
Copy and paste error! The correct hashes were on the release notes were correct, but unfortunately not on the download page.
All fixed now.
Mbed TLS Lead Maintainer