Keytool -list shows various aliases for p12 keystore, depending on whether you specify a password

Question

Really strange behavior in a specific p12 file.

If I run

keytool -list -storetype pkcs12 -keystore my_debug_keystore.p12 -storepass debug keytool -v -list -storetype pkcs12 -keystore my_debug_keystore.p12 -storepass debug 

I get

 Alias name: 1 Creation date: Aug 17, 2014 Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=sixminute, OU=, O=, C=IE Issuer: CN=sixminute, OU=, O=, C=IE Serial number: xxxxxxxxxxxxxxxxx Valid from: Wed Nov 07 13:34:40 GMT 2012 until: Sun Nov 08 13:34:40 GMT 2037 Certificate fingerprints: MD5: xxxxxxxxxxxxxxxxx SHA1: xxxxxxxxxxxxxxxxx Signature algorithm name: SHA1withRSA Version: 3 

and

 Your keystore contains 1 entry 1, Aug 17, 2014, PrivateKeyEntry, Certificate fingerprint (MD5): xxxxxxxxxxxxxxxxx 

However, if I do not enter a password in the commands,

 keytool -list -storetype pkcs12 -keystore my_debug_keystore.p12 keytool -v -list -storetype pkcs12 -keystore my_debug_keystore.p12 

the output is different

 Alias name: 2 Creation date: Aug 17, 2014 Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=sixminute, OU=, O=, C=IE Issuer: CN=sixminute, OU=, O=, C=IE Serial number: 2d36623161363935353a31336165303361636133313a2d38303030 Valid from: Wed Nov 07 13:34:40 GMT 2012 until: Sun Nov 08 13:34:40 GMT 2037 Certificate fingerprints: MD5: xxxxxxxxxxxxxxxxx SHA1: xxxxxxxxxxxxxxxxx Signature algorithm name: SHA1withRSA Version: 3 

and

 Your keystore contains 1 entry 2, Aug 17, 2014, PrivateKeyEntry, Certificate fingerprint (MD5): xxxxxxxxxxxxxxxxx 

In particular, a different alias for the same key (MD5 and SHA1 are still the same for the keys).

Any idea whatsoever, why would that be?

Answer 1

Aliases do not quite represent the concept of PKCS 12. There is a Friendly Name attribute, but it is very optional. Therefore, I would suggest that Java simply composes the alias names it reports. I don’t know why this would be different, since the safe order of the bags should be the same.