Bug ID: JDK-8287354 keytool verbose infos mismatch keys and values after certificate fingerprints in non-English locales

Type: Bug
Component: globalization
Sub-Component: locale-data
Affected Version: openjdk8u292

Priority: P4
Status: New
Resolution: Unresolved

Submitted: 2022-05-26
Updated: 2022-07-22

keytool -genkey -alias test -keypass testkeypass -storepass teststorepass -keyalg RSA -keystore test.keystore -dname 'CN=test' -storetype jks

keytool -list -v -keystore test.keystore -storepass 'teststorepass' -J-Duser.language=fr

Type de fichier de clés : jks
Fournisseur de fichier de clés : SUN

Votre fichier de clés d'accès contient 1 entrée

Nom d'alias : test
Date de création : 26 mai 2022
Type d'entrée : PrivateKeyEntry
Longueur de chaîne du certificat : 1
Certificat[1]:
Propriétaire : CN=test
Emetteur : CN=test
Numéro de série : 7ad92f8e
Valide du : Thu May 26 13:27:29 CST 2022 au : Wed Aug 24 13:27:29 CST 2022
Empreintes du certificat :
	 MD5 : 27:C9:A1:E0:56:AF:67:AD:89:AA:AC:33:AE:FB:43:3C:9F:A1:3C:72
	 SHA1 : 74:3B:84:A1:99:48:71:E3:C5:24:10:3D:1A:5E:6D:76:11:7F:3E:02:74:96:BC:BD:98:6E:71:40:C1:7E:88:7A
	 SHA256 : SHA256withRSA
Nom de l'algorithme de signature : Clé RSA 2048 bits
Algorithme de clé publique du sujet : 3
Version : {10}

Extensions : 

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 28 51 28 C9 80 85 1D 6A   16 B0 09 06 D1 72 E1 E4  (Q(....j.....r..
0010: ED BA 90 80                                        ....
]
]

Because the MD5 fingerprint was removed, so the keys and values are not matching after fingerprints.

The openjdk8u resource files for languages other than English were never updated for the change (JDK-8141457) that removed the MD5 fingerprints.

22-07-2022

MD5 : 27:C9:A1:E0:56:AF:67:AD:89:AA:AC:33:AE:FB:43:3C:9F:A1:3C:72 SHA1 : 74:3B:84:A1:99:48:71:E3:C5:24:10:3D:1A:5E:6D:76:11:7F:3E:02:74:96:BC:BD:98:6E:71:40:C1:7E:88:7A SHA256 : SHA256withRSA Nom de l'algorithme de signature : Clé RSA 2048 bits ... I think the above info should be the below, SHA1 : 27:C9:A1:E0:56:AF:67:AD:89:AA:AC:33:AE:FB:43:3C:9F:A1:3C:72 SHA256 : 74:3B:84:A1:99:48:71:E3:C5:24:10:3D:1A:5E:6D:76:11:7F:3E:02:74:96:BC:BD:98:6E:71:40:C1:7E:88:7A Nom de l'algorithme de signature : SHA256withRSA ... It looks the keys of the message contain MD5, but the the values of the message don't contain any element for that key. You can use the below commands to reproduce this issue with OpenJDK 8u292 or later. keytool -genkey -alias test -keypass testkeypass -storepass teststorepass -keyalg RSA -keystore test.keystore -dname 'CN=test' -storetype jks keytool -list -v -keystore test.keystore -storepass 'teststorepass' -J-Duser.language=fr

14-07-2022

[~jjiang] I don't understand what the issue is, do you have a test case and/or a suggested fix? Can you explain further what you mean "Because the MD5 fingerprint was removed, so the keys and values are not matching after fingerprints."

14-07-2022