Status decoded

Android certificate fingerprint mismatch explained

This result means the package exists in the registration system, but the supplied public certificate fingerprint does not match the credential currently associated with it.

Guide summary

Diagnose an Android package registered with a different signing certificate fingerprint and avoid breaking app updates.

For: Teams migrating CI, adopting Play App Signing, rotating upload keys or inheriting an existing Android app.

Release sequence

  1. Verify whether the tested artifact came from Play, another store, CI or a local build.
  2. Compare the app signing certificate with the upload certificate and legacy keys.
  3. Confirm which certificate signs the artifact users actually install.
  4. Use the official console recovery or update workflow; do not overwrite evidence.

Quick facts

API stateREGISTERED_WITH_ANOTHER_CERTIFICATE_FINGERPRINT
CertificateDoes not match the queried fingerprint
Highest-risk mistakeRotating the wrong key
Field note

A signing identity mistake can block upgrades for existing users. Escalate ambiguous ownership or key history before changing production signing.

Detailed guidance

Identify which certificate the query represents

REGISTERED_WITH_ANOTHER_CERTIFICATE_FINGERPRINT is a successful HTTP 200 state: the package name is registered, but the supplied public certificate differs from the registration record. Compare the queried certificate with the exact artifact users receive. For Play, separate the app-signing certificate from the upload certificate; for another store, inspect that channel's production APK.

If the artifact and fingerprint are correct, check the package's registered keys and use the official add-key or ownership-review flow for a legitimate additional signing identity. Do not try repeated requests or an unplanned key rotation; neither changes the registered certificate.

  • Match the APK, package name and full SHA-256 digest.
  • Check whether Play App Signing or a channel-specific key is involved.
  • Use the console's additional-key or review workflow when the alternate key is legitimate.
  • Do not expose or replace the private signing key to resolve an API state.
Illustrative HTTP 200 response body; not a live query
{
  "name": "packages/com.example.app/packageRegistrationStatus",
  "state": "REGISTERED_WITH_ANOTHER_CERTIFICATE_FINGERPRINT"
}

Have the production package name and signing certificate ready? Query the official registration state, then use the result to choose your next step.

Run status check →

Frequently asked questions

Is the upload certificate the likely fix?

Not automatically. Play-delivered APKs use the app-signing certificate relevant to that artifact and Android version, while the upload certificate authenticates a file sent to Play. Compare certificate roles before changing a query or release setting.

Can key rotation solve the mismatch?

A rotation does not change the certificate already recorded for a distributed artifact. First identify the intended key, then use the console's supported registration or key-change process; an ad-hoc key change can break update continuity.

Sources and review

Last reviewed: