Please take a review at http://cr.openjdk.java.net/~weijun/8177569/webrev.00/ Since our implementation of CertPath validation does not check for the signature algorithm of a root CA, keytool should not warn about its weakness either. Thanks Max