Search code examples
keystoresha1

Is Fingerprint of certificate always the same in keystore?


I checked some certificate its SHA1 in my browser (Firefox). Now I checked if this SHA1 was also in my keystore using:

keytool -list -keystore $PATH

I didn't find the same SHA1 in the keystore but the connection is working. Is it possible the SHA1 is different in the keystore (after adding it) then in the browser?


Solution

  • The certificate fingerprint is a hash computed on the content of the certificate. If the fingerprint is different, then the certificates are different.

    But server certificates do not have to be in the keystore. Only the root certificate of the Certificate Authority. The browser checks the certification chain until it finds one that matches in the keystore.