I checked some certificate its SHA1
in my browser (Firefox).
Now I checked if this SHA1 was also in my keystore using:
keytool -list -keystore $PATH
I didn't find the same SHA1
in the keystore but the connection is working.
Is it possible the SHA1
is different in the keystore (after adding it) then in the browser?
The certificate fingerprint is a hash computed on the content of the certificate. If the fingerprint is different, then the certificates are different.
But server certificates do not have to be in the keystore. Only the root certificate of the Certificate Authority. The browser checks the certification chain until it finds one that matches in the keystore.