Bug ID: JDK-8268444 keytool -v -list print is incorrect after backport JDK-8141457

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

Other
openjdk8u302 b06Fixed

$ ./bin/keytool -v -list -storepass changeit  -keystore ./jre/lib/security/cacerts
8u282:
...
Owner: CN=Actalis Authentication Root CA, O=Actalis S.p.A./03358520967, L=Milan, C=IT
Issuer: CN=Actalis Authentication Root CA, O=Actalis S.p.A./03358520967, L=Milan, C=IT
Serial number: 570a119742c4e3cc
Valid from: Thu Sep 22 19:22:02 CST 2011 until: Sun Sep 22 19:22:02 CST 2030
Certificate fingerprints:
         MD5:  69:C1:0D:4F:07:A3:1B:C3:FE:56:3D:04:BC:11:F6:A6
         SHA1: F3:73:B3:87:06:5A:28:84:8A:F2:F3:4A:CE:19:2B:DD:C7:8E:9C:AC
         SHA256: 55:92:60:84:EC:96:3A:64:B9:6E:2A:BE:01:CE:0B:A8:6A:64:FB:FE:BC:C7:AA:B5:AF:C1:55:B3:7F:D7:60:66
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3
...
8u292:
...
Owner: CN=Actalis Authentication Root CA, O=Actalis S.p.A./03358520967, L=Milan, C=IT
Issuer: CN=Actalis Authentication Root CA, O=Actalis S.p.A./03358520967, L=Milan, C=IT
Serial number: 570a119742c4e3cc
Valid from: Thu Sep 22 19:22:02 CST 2011 until: Sun Sep 22 19:22:02 CST 2030
Certificate fingerprints:
         SHA1: F3:73:B3:87:06:5A:28:84:8A:F2:F3:4A:CE:19:2B:DD:C7:8E:9C:AC
         SHA256: 55:92:60:84:EC:96:3A:64:B9:6E:2A:BE:01:CE:0B:A8:6A:64:FB:FE:BC:C7:AA:B5:AF:C1:55:B3:7F:D7:60:66
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key (3)  // 3 should be the version
Version: {10}  // 10 is wrong
...

URL: https://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/80412c544023 User: fyang Date: 2021-06-11 08:03:34 +0000
11-06-2021
[~dongbohe] Please push to jdk8u/jdk8u directly (not the jdk8u-dev forest). Thanks!
10-06-2021
[~andrew] FYI. I believe this should go as a 8u302 fix. Do you agree?
10-06-2021
Fix Request [8u] Critical fix for jdk8u. 8u RFR: https://mail.openjdk.java.net/pipermail/jdk8u-dev/2021-June/013990.html
10-06-2021
The backport of JDK-8141457 was wrong. It did include ({9,number,#}), but the 8u backport which included this via JDK-8171319 didn't have it: http://hg.openjdk.java.net/jdk8u/jdk8u-dev/jdk/rev/08ea7faa939f#l4.54 This is an 8u-only bug. I don't see this issue in 11u and up.
10-06-2021
Adding a link to JDK-8141457.
10-06-2021

Relates :	JDK-8141457 - keytool default cert fingerprint algorithm should be SHA-256
Relates :	JDK-8171319 - keytool should print out warnings when reading or generating cert/cert req using weak algorithms