"openssl x509 -text" reports signature algorithm twice

[jordanbrown0]

$ openssl x509 -noout -text -in /tmp/crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:3b:e0:56:90:42:46:b1:a1:75:6a:c9:59:91:c7:4a
        Signature Algorithm: sha1WithRSAEncryption
[...]
            X509v3 Authority Key Identifier:
                03:DE:50:35:56:D1:4C:BB:66:F0:A3:E2:1B:1B:C3:97:B2:3D:D1:55
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
[...]

Inspecting the source, it looks like they are reporting the same thing. Still, it's confusing.

OpenSSL 3.0.13, Solaris-supplied and Cygwin-supplied.

[t8m]

This is printing a different field from the X.509 structure. The first one is the signature algorithm from the tbsCertificate, the second one is the signature algorithm from the top level sequence. See the RFC5280.

Yes, this is confusing but that's the way it is. And yeah those values could be different although that would make a malformed, non-compliant X.509.

[jordanbrown0]

Thanks. I guess I misread the docs. Perhaps one or both of them could have new labels that would make the distinction clearer. Or, since 5280 says the two must be the same, perhaps emit one only when it is different from the other, and mark it as an error.

[t8m]

Thanks. I guess I misread the docs. Perhaps one or both of them could have new labels that would make the distinction clearer. Or, since 5280 says the two must be the same, perhaps emit one only when it is different from the other, and mark it as an error.

Yeah, something like this could be considered as a feature.