--- a/jdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java	Wed Jun 14 19:58:49 2017 +0000
+++ b/jdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java	Thu Jun 15 08:34:42 2017 +0800
@@ -181,7 +181,7 @@
     enum Command {
         CERTREQ("Generates.a.certificate.request",
             ALIAS, SIGALG, FILEOUT, KEYPASS, KEYSTORE, DNAME,
-            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
+            EXT, STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
             PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
         CHANGEALIAS("Changes.an.entry.s.alias",
             ALIAS, DESTALIAS, KEYPASS, KEYSTORE, CACERTS, STOREPASS,
@@ -250,12 +250,12 @@
             KEYSTORE, STOREPASS, PROVIDERNAME, ADDPROVIDER,
             PROVIDERCLASS, PROVIDERPATH, V),
         SELFCERT("Generates.a.self.signed.certificate",
-            ALIAS, SIGALG, DNAME, STARTDATE, VALIDITY, KEYPASS,
+            ALIAS, SIGALG, DNAME, STARTDATE, EXT, VALIDITY, KEYPASS,
             STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,
             ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),
         GENCRL("Generates.CRL",
             RFC, FILEOUT, ID,
-            ALIAS, SIGALG, EXT, KEYPASS, KEYSTORE,
+            ALIAS, SIGALG, KEYPASS, KEYSTORE,
             STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,
             PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),
         IDENTITYDB("Imports.entries.from.a.JDK.1.1.x.style.identity.database",