Retrieving The Signing Key Fingerprint on Android

· March 21, 2013

This post is a bit of an aide-mémoire for myself. If you ever need to see which key signed an APK (for example to compare to a client ID in the API console when implementing Google+ Sign-In) you can actually extract the cert from the APK, and test it.

First you need to unzip the APK:

    unzip ~/my-app.apk

You’re going to see a bunch of files extracted, including a CERT.RSA, which is usually in META-INF. If you use an alias for your key, it’ll be THAT-ALIAS.RSA.

    inflating: META-INF/MANIFEST.MF     inflating: META-INF/CERT.SF     inflating: META-INF/CERT.RSA

You can then output the signatures for the certificate with the keytool app:

    keytool -printcert -file META-INF/CERT.RSA

This will print out the various fingerprints, and let you know the details of the certificates owner - handy for checking whether it was accidentally signed with a debug key (which will look something like this):

    Owner: CN=Android Debug, O=Android, C=US     Issuer: CN=Android Debug, O=Android, C=US     Serial number: 4f963ac8     Valid from: Wed Apr 27 12:43:33 BST 2012 until: Fri Apr 20 12:43:33 BST 2042     Certificate fingerprints:         MD5: 84:9E:5D:C5:2C:F5:1A:D5:29:B5:D1:28:DF:1A:6D:86         SHA1: 12:65:36:81:D2:8C:B3:7D:9E:48:55:66:DF:DD:1B:3D:6B:EC:E8:E9         Signature algorithm name: SHA1withRSA         Version: 3