SHA-256 Certificate Fingerprint Verification Guide – DoveRunner Helpcenter

This explains the app signature identity verification feature added from version 3.2.0.0.

To use the signature identity verification feature, you must directly enter the SHA-256 certificate fingerprint value of the certificate used for app signing into the console. Choose the method below that matches your signing method to check the value.

1. When Google Play manages app signing

If Google Play manages your app signing key, you can check the value directly on the console screen without running any additional commands.

Menu path: Select app → Protected with Play → Play Store Protection → Protect app signing key → Manage Play App Signing

※ The Google Play Console menu has been reorganized, so the path has changed. (Previous: App Integrity → Play App Signing → Settings → App Signing Key Certificate)

On the screen you navigate to, you can see the SHA-256 certificate fingerprint (including MD5 and SHA-1) values for the app signing key and the upload key. Copy and use the SHA-256 value as is.

⚠️ Important: Be sure to register the "App signing key" value. The upload key is used only for developer verification when uploading the app bundle to the Play Console, and the APK distributed to actual user devices is signed with the app signing key held by Google. Therefore, only the SHA-256 value of the app signing key should be registered for signature identity verification. Registering the upload key value may cause runtime verification to fail.

2. When the developer manages the signing key directly

Method A. Check from keystore file (if you have the release keystore)

You can check the SHA-256 value by querying the certificate information in the keystore using the JDK keytool command.

Required environment: JDK (Java Development Kit)

Command structure

keytool -list -v -alias {key alias} -keystore {keystore file path}

Example

keytool -list -v -alias appsealing -keystore C:\AppSecurity\release.keystore

When you run the command, you will be asked to enter the keystore password. Enter the SHA256: value from the Certificate fingerprints section of the output into the console.

Certificate fingerprints:
	 SHA256: AB:CD:EF:12:34:...

Method B. Check from an already signed APK/AAB file (if you cannot access the keystore, e.g., builds signed in CI)

Use the apksigner tool included in the Android SDK build-tools.

Command structure

apksigner verify --print-certs {apk_or_aab_file_path}

Example

apksigner verify --print-certs C:\AppSecurity\app-release.apk

Enter the Signer #1 certificate SHA-256 digest value from the output into the console.

⚠️ If multiple signers are displayed: If your app is signed with two or more keys (e.g., with key rotation applied), additional signers such as Signer #2 certificate SHA-256 digest may appear in the output. In this case, you must register the SHA-256 values of all signers in the console to prevent runtime verification errors.

3. Console usage example

After selecting your app, choose version 3.2.0.0 or higher.
In Step 2. Basic Settings menu, enable the signature certificate identity verification checkbox.
Enter a name to identify the key, then enter the SHA-256 hash (using colon delimiter : is acceptable).
Click the Save button to confirm the saved entry, then proceed with applying security.
You can save up to 5 certificate SHA-256 hash entries. You can pre-register keys for development, distribution, etc., for convenient use.

Precautions

App will forcibly close if certificates do not match: If the SHA-256 value registered in the console does not match the signing key certificate of the actually distributed app, the app will be considered unofficial and will be terminated. Please double-check for typos or incorrect keys (such as upload keys).
Internal test/debug builds must also be registered: If you distribute builds signed with a debug key (debug.keystore) or a separate release key different from production for internal testing, the app may terminate during testing unless those keys are also registered. All signing keys used for builds installed on actual devices must be registered without exception to avoid runtime termination.
Apps signed with multiple keys: If an app is signed with two or more signing keys (e.g., builds with signing key rotation applied), additional signers such as Signer #2 may appear when running apksigner verify --print-certs. In this case, you must register the SHA-256 values of all signers.
If you replace (rotate) signing keys: If you are currently using or planning to switch signing keys from key A to key B, please make sure to read the additional precautions in the document below.

APK Signature Scheme v3 Key Rotation Verification Guide

Reference Documents