Summary

Update the keytool functionality in upcoming JDK 7u and JDK 8u Oracle releases so that SHA-256 is default certificate fingerprint algorithm (instead of SHA-1)

JDK 9 and later already use SHA-256.

Problem

keytool still uses SHA-1 as the default certificate fingerprint algorithm in JDK 7u/8u. SHA-1 is considered a security risk as of today and should be avoided where possible.

Solution

Update the default algorithm to SHA-256. Since not all other CA and certificate-related tools include the SHA-256 fingerprint, SHA-1 is kept in the full list for interop. reasons.

Specification

A release note will accompany this change to indicate that SHA-256 is the default fingerprint algorithm.