[BUG] keystore state uses incorrect key to get SHA1 fingreprint

Description
salt.states.keystore.managed appears to be looking for incorrect key when trying to get the SHA1 fingerprint from a certfile.

Using x509_v2 in minion config:

features:
  x509_v2: true

It is able to successfully run and create the keystore files initially, but on consecutive runs, it throws the following error:

[ERROR   ] An exception occurred in this state: Traceback (most recent call last):
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/keystore.py", line 92, in managed
    new_sha1 = __salt__["x509.read_certificate"](entry["certificate"])[
KeyError: 'SHA1 Finger Print'

https://github.com/saltstack/salt/blob/2b364c92e6319ec3a9884afff10e6e4e1e1642db/salt/states/keystore.py#L92

Reading the cert manually with x509.read_certificate gives the following structure:

$ salt-call x509.read_certificate /path/to/certificate.pem
local:
    ----------
    ...
    fingerprints:
        ----------
        md5:
            5A:FA:...:3C:38
        sha1:
            5D:7F:...:8E:B1
        sha256:
            9F:3B:...:EF:D5

Changing the keystore.py file with something like this seems to make it work as expected:

             if existing_entry:
                 existing_sha1 = existing_entry[0]["sha1"]
                 try:
-                    new_sha1 = __salt__["x509.read_certificate"](entry["certificate"])[
-                        "SHA1 Finger Print"
-                    ]
+                    new_sha1 = __salt__["x509.read_certificate"](entry["certificate"])['fingerprints']['sha1'].encode(__salt_system_encoding__)
                 except (KeyError, TypeError) as err:
                     log.debug(
                         "Unable to obtain SHA1 finger print from entry's certificate"

Setup
The sls file I'm running contains some fairly simple state definitions:

/path/to/keystore1.jks:
  keystore.managed:
    - passphrase: ...
    - entries:
      - alias: {{ grains['id'] }}
        certificate: /path/to/certificate.pem
        private_key: /path/to/certificate.key

/path/to/keystore2.jks:
  keystore.managed:
    - passphrase: ...
    - force_remove: True
    - entries:
      - alias: ca1
        certificate: /path/to/ca1.pem
      - alias: ca2
        certificate: /path/to/ca2.pem

• on-prem machine
• VM (Virtualbox, KVM, etc. please specify)
• VM running on a cloud service, please be explicit and add details
• container (Kubernetes, Docker, containerd, etc. please specify)
• or a combination, please be explicit
• jails if it is FreeBSD
• classic packaging
• onedir packaging
• used bootstrap to install

Expected behavior
Expect the keystore state to function as documented.

Versions Report
$ salt-call --versions-report
Salt Version:
Salt: 3006.6

Python Version:
Python: 3.10.13 (main, Nov 15 2023, 04:34:27) [GCC 11.2.0]

Dependency Versions:
cffi: 1.14.6
cherrypy: 18.6.1
dateutil: 2.8.1
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 3.1.3
libgit2: Not Installed
looseversion: 1.0.2
M2Crypto: 0.40.1
Mako: Not Installed
msgpack: 1.0.2
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 22.0
pycparser: 2.21
pycrypto: Not Installed
pycryptodome: 3.19.1
pygit2: Not Installed
python-gnupg: 0.4.8
PyYAML: 6.0.1
PyZMQ: 23.2.0
relenv: 0.14.2
smmap: Not Installed
timelib: 0.2.4
Tornado: 4.5.3
ZMQ: 4.3.4

System Versions:
dist: debian 12 bookworm
locale: utf-8
machine: x86_64
release: 6.1.0-17-cloud-amd64
system: Linux
version: Debian GNU/Linux 12 bookworm

Start in salt/states/keystore.py around line 92 and compare the certificate data returned by x509.read_certificate with the key used for the SHA1 fingerprint lookup. Reproduce the issue with the provided keystore.managed state and verify that consecutive runs complete without the KeyError and preserve the expected keystore behavior.