http://docs.oracle.com/javase/8/docs/technotes/guides/jweb/security/deployment_rules.html#gethash says to remove the colons from the hash value before assigning to the hash attribute of the certificate element.

According to JDK-8022271, this is not necessary, so the doc should be updated to remove the unnecessary step.