How to Code Sign Secured Android App with SHA Fingerprint Google Cert in DevSecOps Build System

Last updated December 31, 2023 by Appdome

 

Some Android developers may elect to sign their apps using Google Play, and allow Google to manage the app signing certificate. In effect they will Sign Secured Android App with SHA Fingerprint Google Cert. In order to do so, you need to first extract a SHA-1 or SHA-256 Fingerprint from the Google Play signing certificate.

This Knowledge Base article provides instructions on how to extract a SHA-1 or SHA-256 fingerprint from a Google Play signing certificate in order to sign and manage certificates on Google Play. (sometimes this is done to allow Google to send different configurations to specific Android devices).

How to sign apps on Google Play

Appdome is a mobile security platform that allows users to add a wide variety of features, SDKs and APIs to Android and iOS apps. Using a simple ‘click to add’ user interface, Appdome allows anyone to easily integrate features to any mobile app – instantly, no code or coding required.

To use Appdome’s signing or private signing with an app meant to be re-signed on Google Play, you need to extract the SHA-1 or SHA-256 fingerprint from the app signing certificate from your Google Play account.

To sign apps on Google Play, you need to enable the option “Use Google Play App Signing“ while signing on the Appdome platform before uploading the Appdome-built app to Google Play. This option is located under the “Sign” tab after you fuse an Android app.  If you don’t enable “Use Google Play App Signing“ when you sign or privately sign your app on the Appdome platform,  Google Play re-signing will trigger the Appdome Anti-Tampering security mechanism.

Prerequisites

  1. Appdome account
  2. Android App
  3. Application uploaded to Google PlayStore
  4. Signing Credentials

How to Extract a SHA-1 or SHA-256 Fingerprint from the Google Play Signing Certificate

For Internal Testing and App Releases

After logging into Google Play you can extract a SHA-1 or SHA-256 certificate fingerprint and copy that into Appdome when signing on Appdome  or Private Signing:

Navigate to the Google Play Console and log-in (or access Google Play from an Android device)

  1. Choose the application you are signing
  2. Go to Release Management –> App Signing
  3. Copy/Download the SHA-1 or SHA-256 certificate fingerprint from the App signing certificate section
Extract a SHA-1 or SHA-256 fingerprint on Google Play from .apk file
How to Extract an SHA-1 or SHA-256 fingerprint from Google Play certificate

This app signing certificate (SHA-1 or SHA-256) is the fingerprint of the final signing certificate that will be distributed via Google Play. Insert this value while signing or private signing on Appdome.

 

For Internal App Sharing

After logging into Google Play you can extract a SHA-1 or SHA-256 certificate fingerprint and copy that into Appdome when signing on Appdome  or Private Signing:

Navigate to the Google Play Console and log-in (or access Google Play from an Android device)

  1. Choose the application you are signing
  2. Go to Development tools –> Internal App Sharing
  3. Copy/Download the SHA-1 or SHA-256 certificate fingerprint from the App certificate section

This app signing certificate (SHA-1 or SHA-256) is the fingerprint of the signing certificate that will be used for the app internal sharing. Insert this value while signing or private signing on Appdome.

 

3 Easy Steps to Sign Secured Android App with SHA Fingerprint Google Cert

Follow these step-by-step instructions to Sign Secured Android App with SHA Fingerprint Google Cert.

  1. Build your secured app on Appdome
  2. Add your SHA Fingerprint Signing Certificate
  3. Click sign my app

Below are the screenshot with detailed instructions for signing on Appdome and signing privately.

Sign on Appdome:

Example of signing an app with Appdome's platform for Google App signing

Private signing:

Example of private signing an app with Appdome for Google App Signing

The reason Appdome requires this value is that several Anti-Tampering techniques within Appdome ONEShield rely on the final signing certificate fingerprint in order to protect the application and verify that it has not been re-signed by an attacker or otherwise tampered with.

For more information on Google App signing, visit this resource.

To zoom out on this topic, visit  Appdome for Mobile App Security on our website.

How Do I Learn More?

Check out the Appdome blog or request a demo at any time.
If you have any questions, please send them our way at support.appdome.com or via the chat window on the Appdome platform.

Thank you!

Thanks for visiting Appdome! Our mission is to secure every app on the planet by making mobile app security easy. We hope we’re living up to the mission with your project. If you don’t already have an account, you can sign up for free.

Appdome

Want a Demo?

Automated Signing of Secured Mobile Apps

GilWe're here to help
We'll get back to you in 24 hours to schedule your demo.