Verifying the authenticity of an APK/AAB

You can verify the authenticity/integrity of an APK/AAB file received from Speakap by checking its signature/fingerprint and comparing it to the values here. If the values are the same, this guarantees that the file has not been altered after we signed it.

We advise you to do this if you receive builds from us outside the Google Play store.

Depending on whether you are verifying an APK or AAB file, you need to use different CLI tools and commands.

Commands

For APK file:

apksigner verify --print-certs app-example-release.apk

For AAB file:

keytool -printcert -jarfile app-example-release.aab

Our certificates

We use two certificates. Your APK/AAB will be signed with one of them. 

When you run the command, you should get exactly the same values as for one of the certificates below.

Certificate 1

SHA-256 certificate fingerprint

49:0B:36:AD:7E:A8:7C:CF:C6:45:B1:DB:5A:66:0D:9F:FE:3F:E8:03:4C:81:48:4B:23:C7:3C:4F:44:96:A6:40

SHA-1 certificate fingerprint

5F:51:D8:79:F7:02:FE:5D:A6:C2:3E:8D:12:52:4A:31:8C:FE:95:D3

MD5 certificate fingerprint

40:51:CE:2F:CD:64:F9:A7:CF:52:3E:03:65:AB:CD:D1

Certificate 2

SHA-256 certificate fingerprint

15:5D:46:AE:9D:32:A0:0C:2E:25:4F:B5:60:4E:DD:DC:EC:15:B2:0D:80:66:1F:EF:91:54:23:7C:9D:F3:9C:A6

SHA-1 certificate fingerprint

39:67:BE:F6:BC:CC:69:9B:58:A0:2B:A4:C2:E1:75:E1:42:E9:D4:E2

MD5 certificate fingerprint

53:EE:BB:72:94:3D:32:20:8F:AA:C4:D8:1C:89:26:F1

More info

Getting the tools

On Mac:

• /Users/user/Library/Android/sdk/build-tools/xx.x.x/apksigner
• /Applications/Android\ Studio.app/Contents/jbr/Contents/Home/bin/keytool 
• /Users/user/Library/Java/JavaVirtualMachines/jbr-xx.x.xx/Contents/Home/bin/keytool

Command output for an APK file signed with Certificate 1

Signer #1 certificate DN: CN=Patrick van der Mijl, OU=Speakap, O=Speakap, L=Amsterdam, ST=Noord-Holland, C=NL

certificate SHA-256 digest: 490b36ad7ea87ccfc645b1db5a660d9ffe3fe8034c81484b23c73c4f4496a640

certificate SHA-1 digest: 5f51d879f702fe5da6c23e8d12524a318cfe95d3

certificate MD5 digest: 4051ce2fcd64f9a7cf523e0365abcdd1

Command output for an AAB file signed with Certificate 2

Owner: CN=Patrick van der Mijl, O=Speakap, C=NL

Issuer: CN=Patrick van der Mijl, O=Speakap, C=NL

Serial number: 2999e34b

Certificate fingerprints:

    SHA1: 39:67:BE:F6:BC:CC:69:9B:58:A0:2B:A4:C2:E1:75:E1:42:E9:D4:E2

    SHA256: 15:5D:46:AE:9D:32:A0:0C:2E:25:4F:B5:60:4E:DD:DC:EC:15:B2:0D:80:66:1F:EF:91:54:23:7C:9D:F3:9C:A6