When printing the SHA-256 hash in any tool (like keytool), the output is colon-delimited (:) yet Deployment Rule Set only accepts non-delimited. This presents system administrator's copy+paste and easy searching.

Example output for Oracle's cert:
79:4F:53:C7:46:E2:AA:77:D8:4B:84:3B:E9:42:CA:B4:30:9F:25:8F:D9:46:D6:2A:6C:4C:CE:AB:8E:1D:B2:C6
The value accepted by deployment rule set:
794F53C746E2AA77D84B843BE942CAB4309F258FD946D62A6C4CCEAB8E1DB2C6


keytool -printcert -jarfile x.jar
Signer #1:

Signature:

Owner: CN="Oracle America, Inc.", OU=Software Engineering, OU=Digital ID Class 3 - Java Object Signing, O="Oracle America, Inc.", L=Redwood Shores, ST=California, C=US
Issuer: CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Serial number: 69e9afd151b4e0eae925a4d4b1b57d29
Valid from: Mon Jan 21 16:00:00 PST 2013 until: Fri Jan 22 15:59:59 PST 2016
Certificate fingerprints:
MD5: 4A:64:03:D2:D1:23:58:8F:C4:42:82:24:57:6F:B2:B9
SHA1: 4E:06:7F:79:41:97:EE:2B:81:1D:F2:C5:03:E2:E5:54:2A:87:8D:2B
SHA256: 79:4F:53:C7:46:E2:AA:77:D8:4B:84:3B:E9:42:CA:B4:30:9F:25:8F:D9:46:D6:2A:6C:4C:CE:AB:8E:1D:B2:C6