Guide summary
Understand which certificate fingerprint matters when Google Play manages the app signing key and your CI uses a separate upload key.
For: Play Console users investigating a certificate mismatch or documenting signing ownership.
Release sequence
- Open the app integrity or signing section in Play Console.
- Record both the app signing certificate and upload certificate fingerprints.
- Use the production app signing certificate for the delivered package identity.
- Keep the upload certificate in release documentation for CI troubleshooting.
Quick facts
Do not rotate or reset a key solely because a checker reports a mismatch. First confirm which certificate signed the distributed artifact.
Detailed guidance
Map upload and delivery identities
Your CI normally signs an Android App Bundle with the upload key. Google Play verifies that upload, then signs APKs delivered to users with the app signing key. A status check against the upload certificate can therefore report a mismatch even when the delivered app is registered correctly.
Document both fingerprints and label them explicitly. When diagnosing an existing install, compare against the app signing certificate shown in Play Console and the certificate on the delivered APK.
- App signing key: identity of Play-delivered APKs.
- Upload key: authenticates uploads to Play.
- Legacy key: may still matter for older or non-Play builds.
Frequently asked questions
Should I rotate the upload key after a mismatch?
Not until you confirm which certificate was queried. A mismatch can simply mean the app signing certificate should have been used.
Can a non-Play build use the same key?
It can, but many teams use a separate channel workflow. Inspect each distributed artifact rather than assuming.
Sources and review
Last reviewed: