0

I'm making an Android app using Expo. I download the upload certificate from Google Play Console. It's a .der file. I run:

keytool -importcert -file certificate.der -alias someAlias -keystore some.keystore

This creates a .keystore file of type .jks with 3 certificate fingerprints. The one which Google Play Console looks at during upload is the SHA1 fingerprint, which has 19 pairs of values such as 01:02:A1...

Using either expo build:android -t apk -c or expo build:android -t app-bundle -c to reset my keys and build an .apk or .aap, respectively, upon uploading to the Google Play Console, I receive an error that I haven't used the right key.

I get these errors:

.Apk error: You uploaded an APK that is not signed with the upload certificate. You must use the same certificate. The upload certificate has fingerprint: SHA1: 01:02:A1... - The fingerprint of my newly created .keystore according to keytool -list -v -keystore some.keystore; the error goes on to say - and the certificate used to sign the APK you uploaded has fingerprint: SHA1: 98:97:96:... - an entirely different fingerprint.

.Aap error: Your Android App Bundle is signed with the wrong key. Ensure that your App Bundle is signed with the correct signing key and try again: SHA1: 55:66:77... - another completely different value.

I used the upload .der for the .apk version app build and the app signing .der for the .aap version app build, and both times the Google Play Console read a different value for the SHA1 fingerprint than the value which Keytool read for the same .keystore.

Switching keys, nor re-downloading, nor rebuilding had any affect, and keytool -list always claim that the .keystore fingerprints match what the Google Play Console is asking for.

Is there something simple I'm missing? Any help appreciated.

Jesse Falcon-Musik
  • 13
  • 1
  • 5

1 Answers1

0

I've answered a similar question in detail in How to use upload certificate to release an app update? but in short, you cannot use a certificate to sign an APK or App Bundle: the certificate only contains the public key while you need the private key to sign an APK or App Bundle.

Google does not have the private key so you can't download it from the Play Console. You need to use the same keystore that you used to sign your first APK you uploaded to the console, you cannot create a new one.

If you've lost that keystore, you need to contact the Play developer support and let them know, they'll give you instructions on how to reset it.

Pierre
  • 15,865
  • 4
  • 36
  • 50