How do I find out which keystore was used to sign an app?

Question

I have an app which is signed and several keystore files. I'd like to update the app, so I need to find out which one of keys was used.

How can I match which keystore was used to originally sign my app against various keystores I have on my machine?

Humorist

I have no idea can you find it or not, but if you sign app with wrong key, developer console(where you publish apps) will tell you that it is wrong. You can try them all. – Twayblade

There is an public key 'developer console' > 'Edit Profile'. Can i use it anyhow to help myself? – Humorist

how to recreate the keystore file if it got deleted accidentally? – Unbelt

@Maveňツ you can't. If you loose your keystore, you are toast. Google did introduce [App Signing], where they hold on to the signing information. [App Signing]: support.google.com/googleplay/android-developer/answer/… – Clemmieclemmons

Answer 1

First, unzip the APK and extract the file /META-INF/ANDROID_.RSA (this file may also be CERT.RSA, but there should only be one .RSA file).

Then issue this command:

keytool -printcert -file ANDROID_.RSA

You will get certificate fingerprints like this:

     MD5:  B3:4F:BE:07:AA:78:24:DC:CA:92:36:FF:AE:8C:17:DB
     SHA1: 16:59:E7:E3:0C:AA:7A:0D:F2:0D:05:20:12:A8:85:0B:32:C5:4F:68
     Signature algorithm name: SHA1withRSA

Then use the keytool again to print out all the aliases of your signing keystore:

keytool -list -keystore my-signing-key.keystore

You will get a list of aliases and their certificate fingerprint:

android_key, Jan 23, 2010, PrivateKeyEntry,
Certificate fingerprint (MD5): B3:4F:BE:07:AA:78:24:DC:CA:92:36:FF:AE:8C:17:DB

Voila! we can now determined the apk has been signed with this keystore, and with the alias 'android_key'.

Keytool is part of Java, so make sure your PATH has Java installation dir in it.

Kissie

Thank you for this. I added a tool for doing this to my github project. github.com/RichardBronosky/ota-tools/blob/master/… – Renin

Hi I don't understand this command ~ keytool -list -keystore my-signing-key.keystore , what's my-signing-key.keystore – Floorboard

@Floorboard my-signing-key.keystore is the name of the keystore file containing the keys that are used to sign the apk – Madigan

Thanks a lot for this! Our app was re-signed by PlayStore and it causes Google login to fail. I had to download the APK directly from PlayStore and find the actual SHA1 to register it in the Google Cloud console. – Conga

Google has introduced two new APK signature schemes, neither of which use traditional JAR signing with an embedded file. keytool cannot read these signatures. Use apksigner instead. – Reverie

Answer 2

Gradle Signing Report

The easiest way to output the signing information of each of your app's variants, is by using the Gradle Signing Report.

./gradlew signingReport

> Task :app:signingReport
Variant: debug
Config: debug
Store: ~/.android/debug.keystore
Alias: AndroidDebugKey
MD5: A5:88:41:04:8D:06:71:6D:FE:33:76:87:AC:AD:19:23
SHA1: A7:89:E5:05:C8:17:A1:22:EA:90:6E:A6:EA:A3:D4:8B:3A:30:AB:18
SHA-256: 05:A2:2C:35:EE:F2:51:23:72:4D:72:67:A5:6C:8C:58:22:2A:00:D6:DB:F6:45:D5:C1:82:D2:80:A4:69:A8:FE
Valid until: Wednesday, August 10, 2044

Signature of an APK or AAB

Alternatively, you can use Java 7's Key and Certificate Management Tool keytool to check the signature of a keystore or an APK without extracting any files.

# APK file
keytool -printcert -jarfile app.apk

# AAB file
keytool -printcert -jarfile app.aab

The output will reveal the signature owner/issuer and MD5, SHA1 and SHA256 fingerprints of the APK file app.apk or AAB file app.aab.

(Note that the -jarfile argument was introduced in Java 7; see the documentation for more details.)

Signature of a keystore

Similarly, you can check the signature of the keystore used to sign your application.

keytool -list -v -keystore release.jks

The output will reveal the aliases (entries) in the keystore file release.jks, with the certificate fingerprints (MD5, SHA1 and SHA256).

Note that if you are using Play App Signing, your upload key may differ from the key used by Google Play to sign your app. In this case, you can find the app signature from the Google Play Console on the Release > Setup > App Integrity page.

This process is documented on the Google developer site:
https://developers.google.com/android/guides/client-auth

In conclusion

If the SHA1 fingerprints between the APK and the keystore match, then you can rest assured that that app is signed with the key.

Antioch

@goRGon Are you using Java 7 or later? – Antioch

No. Java 7 brought too many problems =) So it works only on Java 7? Could you please mention it inside your answer? – Kevinkevina

@Kevinkevina Indeed, the -jarfile argument was introduced with Java 7. I've updated the answer. – Antioch

This should be an accepted answer. No unzipping needed – Kirman

If this worked with the Java shipped with the current MacOS, it would be the be THE answer. Until then it's another answer. Let's face it, if you are doing Android dev, you are also doing iOS dev. (upvoted still) – Renin

It's odd that Java 1.6 is still shipped by default on Mac. I'd recommend updating to a more recent version. – Antioch

@RichardBronosky That's not true indeed. I have been an Android developer for more than three years without doing iOS dev. Though, I agree with your main point for different reasons. Java 1.6 seems to be the most extended version so far, or at least widespread, and whilst the accepted solution works with both 1.6 and 1.7, this one will only work with 1.7, so I don't think this should be the accepted answer (yet!). (Also note that the accepted answer is form 2012, whilst this one is from April, 2014) – Tin

I had the issue with google Maps v2 because I uploaded the release.apk but on my Android Studio when I used keytool -list -v -keystore keystore.jks -alias alias -storepass storepass -keypass keypass I received the debug SHA1 and not the release one. With keytool -list -printcert -jarfile app.apk I fixed everything. Thanks @Paul Lammertsma – Karlynkarma

I was able to execute it using java 1.6 without any problems. – Owsley

This also works for Android app bundle .aab files :-) – Verduzco

Answer 3

To build on Paul Lammertsma's answer, this command will print the names and signatures of all APKs in the current dir (I'm using sh because later I need to pipe the output to grep):

find . -name "*.apk" -exec echo "APK: {}" \; -exec sh -c 'keytool -printcert -jarfile "{}"' \;

Sample output:

APK: ./com.google.android.youtube-10.39.54-107954130-minAPI15.apk
Signer #1:

Signature:

Owner: CN=Unknown, OU="Google, Inc", O="Google, Inc", L=Mountain View, ST=CA, C=US
Issuer: CN=Unknown, OU="Google, Inc", O="Google, Inc", L=Mountain View, ST=CA, C=US
Serial number: 4934987e
Valid from: Mon Dec 01 18:07:58 PST 2008 until: Fri Apr 18 19:07:58 PDT 2036
Certificate fingerprints:
         MD5:  D0:46:FC:5D:1F:C3:CD:0E:57:C5:44:40:97:CD:54:49
         SHA1: 24:BB:24:C0:5E:47:E0:AE:FA:68:A5:8A:76:61:79:D9:B6:13:A6:00
         SHA256: 3D:7A:12:23:01:9A:A3:9D:9E:A0:E3:43:6A:B7:C0:89:6B:FB:4F:B6:79:F4:DE:5F:E7:C2:3F:32:6C:8F:99:4A
         Signature algorithm name: MD5withRSA
         Version: 1

APK: ./com.google.android.youtube_10.40.56-108056134_minAPI15_maxAPI22(armeabi-v7a)(480dpi).apk
Signer #1:

Signature:

Owner: CN=Unknown, OU="Google, Inc", O="Google, Inc", L=Mountain View, ST=CA, C=US
Issuer: CN=Unknown, OU="Google, Inc", O="Google, Inc", L=Mountain View, ST=CA, C=US
Serial number: 4934987e
Valid from: Mon Dec 01 18:07:58 PST 2008 until: Fri Apr 18 19:07:58 PDT 2036
Certificate fingerprints:
         MD5:  D0:46:FC:5D:1F:C3:CD:0E:57:C5:44:40:97:CD:54:49
         SHA1: 24:BB:24:C0:5E:47:E0:AE:FA:68:A5:8A:76:61:79:D9:B6:13:A6:00
         SHA256: 3D:7A:12:23:01:9A:A3:9D:9E:A0:E3:43:6A:B7:C0:89:6B:FB:4F:B6:79:F4:DE:5F:E7:C2:3F:32:6C:8F:99:4A
         Signature algorithm name: MD5withRSA
         Version: 1

---

Or if you just care about SHA1:

find . -name "*.apk" -exec echo "APK: {}" \; -exec sh -c 'keytool -printcert -jarfile "{}" | grep SHA1' \;

Sample output:

APK: ./com.google.android.youtube-10.39.54-107954130-minAPI15.apk
         SHA1: 24:BB:24:C0:5E:47:E0:AE:FA:68:A5:8A:76:61:79:D9:B6:13:A6:00
APK: ./com.google.android.youtube_10.40.56-108056134_minAPI15_maxAPI22(armeabi-v7a)(480dpi).apk
         SHA1: 24:BB:24:C0:5E:47:E0:AE:FA:68:A5:8A:76:61:79:D9:B6:13:A6:00

Gil

Interesting! I've used a very similar approach in a validation on our privately hosted distribution store to inform the user that the app was not signed correctly. I also take special note to observe if the key alias is "androiddebugkey" to display a differently worded message. I think Google Play does validation in much the same way. I suppose you're using this to validate APKs on APKMirror? – Antioch

@PaulLammertsma Yes, we are. – Gil

Answer 4

You can do this with the apksigner tool that is part of the Android SDK:

apksigner verify --print-certs my_app.apk

You can find apksigner inside the build-tools directory. For example: ~/Library/Android/sdk/build-tools/29.0.1/apksigner

Amu

apksigner does not print the certificates for split apks (those that come with the base.apk for an app distributed as a bundle (aab); the keytool does. – Obliging

Answer 5

Much easier way to view the signing certificate:

jarsigner.exe -verbose -verify -certs myapk.apk

This will only show the DN, so if you have two certs with the same DN, you might have to compare by fingerprint.

Inoffensive

What is DN? Mostly i got many lines like this: X.509, CN={firstname and lastname} [certificate is valid from {date from} to {date_to}] – Humorist

DN stands for 'Distinguished Name', in your case it's the 'CN={firstname and lastname}' part. – Inoffensive

Answer 6

There are many freewares to examine the certificates and key stores such as KeyStore Explorer.

Unzip the apk and open the META-INF/?.RSA file. ? shall be CERT or ANDROID or may be something else. It will display all the information associated with your apk.

Paget