密钥工具-list -v和密钥工具-list返回不同的输出

Question

当我执行此命令：

keytool -list -keystore %JAVA_HOME%/jre 
/lib/security/cacerts 

我接收到这样的输出：

ascom-ws, 27.05.2016, trustedCertEntry, 
Certificate fingerprint (SHA1): 0D:45:B8:00:6D:94:81:DB:4F:60:D4:6E:E5:3B:5D:F6:B9:4C:D2:F9 

从中我明白，这证书是SHA1证书。

然而，当我执行此命令：

keytool -list -v -keystore %JAVA_HOME%/jre 
/lib/security/cacerts 

我接收这个输出：

Alias name: ascom-ws 
Creation date: 27.05.2016 
Entry type: trustedCertEntry 

Owner: CN=*.ascom-ws.com, O=Ascom (Sweden) AB, L=Gothenburg, ST=Gothenburg, C=SE 
Issuer: CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US 
Serial number: fb34f8c44b6d2cb3f92593f8fe7e67d 
Valid from: Tue Oct 06 02:00:00 CEST 2015 until: Fri Dec 14 13:00:00 CET 2018 
Certificate fingerprints: 
    MD5: A4:8E:49:4F:2C:10:C6:94:80:C5:6A:DC:13:72:CF:F0 
    SHA1: 0D:45:B8:00:6D:94:81:DB:4F:60:D4:6E:E5:3B:5D:F6:B9:4C:D2:F9 
    SHA256: 2D:24:07:41:C0:1B:9D:70:DF:CB:13:0A:C9:18:1B:A4:12:25:B7:53:C7:99:09:ED:2F:E2:CA:12:3A:BF:F8:4A 
    Signature algorithm name: SHA256withRSA 
    Version: 3 

Extensions: 

#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false 
AuthorityInfoAccess [ 
    [ 
    accessMethod: ocsp 
    accessLocation: URIName: http://ocsp.digicert.com 
, 
    accessMethod: caIssuers 
    accessLocation: URIName: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt 
] 
] 

#2: ObjectId: 2.5.29.35 Criticality=false 
AuthorityKeyIdentifier [ 
KeyIdentifier [ 
0000: 51 68 FF 90 AF 02 07 75 3C CC D9 65 64 62 A2 12 Qh.....u<..edb.. 
0010: B8 59 72 3B          .Yr; 
] 
] 

#3: ObjectId: 2.5.29.19 Criticality=true 
BasicConstraints:[ 
    CA:false 
    PathLen: undefined 
] 

#4: ObjectId: 2.5.29.31 Criticality=false 
CRLDistributionPoints [ 
    [DistributionPoint: 
    [URIName: http://crl3.digicert.com/sha2-ha-server-g4.crl] 
, DistributionPoint: 
    [URIName: http://crl4.digicert.com/sha2-ha-server-g4.crl] 
]] 

#5: ObjectId: 2.5.29.32 Criticality=false 
CertificatePolicies [ 
    [CertificatePolicyId: [2.16.840.1.114412.1.1] 
[PolicyQualifierInfo: [ 
    qualifierID: 1.3.6.1.5.5.7.2.1 
    qualifier: 0000: 16 1C 68 74 74 70 73 3A 2F 2F 77 77 77 2E 64 69 ..https://www.di 
0010: 67 69 63 65 72 74 2E 63 6F 6D 2F 43 50 53  gicert.com/CPS 

]] ] 
    [CertificatePolicyId: [2.23.140.1.2.2] 
[] ] 
] 

#6: ObjectId: 2.5.29.37 Criticality=false 
ExtendedKeyUsages [ 
    serverAuth 
    clientAuth 
] 

#7: ObjectId: 2.5.29.15 Criticality=true 
KeyUsage [ 
    DigitalSignature 
    Key_Encipherment 
] 

#8: ObjectId: 2.5.29.17 Criticality=false 
SubjectAlternativeName [ 
    DNSName: *.ascom-ws.com 
    DNSName: ascom-ws.com 
] 

#9: ObjectId: 2.5.29.14 Criticality=false 
SubjectKeyIdentifier [ 
KeyIdentifier [ 
0000: 67 8B 3F 98 ED 79 21 03 59 95 82 CC FE 4A EA DF g.?..y!.Y....J.. 
0010: F8 C3 55 7C          ..U. 
] 
] 

从中我明白，这证书是证书SHA2。是对的吗？

Answer 1

当你看起来更详细，你可以看到，当您使用的详细选项-v你也有你没有详细的选项结果：

Certificate fingerprints: 
    MD5: A4:8E:49:4F:2C:10:C6:94:80:C5:6A:DC:13:72:CF:F0 
    ---> SHA1: 0D:45:B8:00:6D:94:81:DB:4F:60:D4:6E:E5:3B:5D:F6:B9:4C:D2:F9 
    SHA256: 2D:24:07:41:C0:1B:9D:70:DF:CB:13:0A:C9:18:1B:A4:12:25:B7:53:C7:99:09:ED:2F:E2:CA:12:3A:BF:F8:4A 
    Signature algorithm name: SHA256withRSA 
    Version: 3 

的-v选项真的只能告诉你更多的信息。

，所以你可以看到，签名算法这里是SHA256withRSA

但签名不是证书类型。

证书可能是X.509证书

Answer 2

指纹未定义证书类型，是DER格式（SHA-1，MD5等）中整个证书的散列（单向），要知道证书签名类型，请参阅签名算法名称（公钥+摘要算法）在这种情况下，您的证书签名是SHA2签名（带有RSA公钥的SHA256），但您的证书类型是带有RSA公钥的（可信证书条目）x509。