Google Play update
If your app uses Play App Signing, Google retains the app-signing key. Upload the key you use to sign submissions sent to Play and include the Play Console certificate fingerprints for review.
Most Play customersKeep every protected update installable.
An APK signature is more than a release stamp. It is the identity Android uses to decide whether a new build is allowed to replace the one already installed.
Why signing continuity matters
When Defract protects an APK, the resulting file must be signed again. Android normally accepts it as an update only when its signer matches the installed application, or when Android can validate an authorized signing lineage.
A certificate is not a private key. A certificate fingerprint lets us compare identities, but signing the protected APK requires access to the corresponding private key through a keystore or an appropriate Play upload-key workflow.
Which key should you provide?
Direct distribution
Provide the same private signing key used for the currently installed application. A different key normally creates a separate, non-updatable identity.
Fresh evaluation
Use Defract’s evaluation signer only when no production update path is required and you can install the test APK from scratch.
Before you submit
- Confirm whether Google Play App Signing is enabled.
- Match your uploaded key fingerprint to the intended release path.
- Keep keystore passwords out of portal messages.
- Retain a secure backup under your organization’s key policy.
Find the certificate fingerprint
Use the Android SDK’s apksigner to inspect the APK that users currently receive:
TerminalAPK verification
apksigner verify --print-certs your-app.apkFor a Java keystore, keytool can print the certificate associated with an alias:
TerminalKeystore certificate
keytool -list -v -keystore release.jks -alias your-key-aliasDo not paste private keys or keystore passwords into a message. Fingerprints are safe to compare; secrets belong only in the encrypted signing-material flow.
The Defract evaluation key
It is not a production update key.
The evaluation signer will not match your existing production app. Android or Google Play will normally reject that APK as an update. You may need to uninstall the current app before installing the test build, which removes local application data.
The portal blocks this option for profiles marked as Play Store or existing direct-distribution updates. It remains available for explicit evaluation profiles after acknowledgement.
Official Android documentation
Android DevelopersSign your app
Android’s guide to keys, certificates, signing configurations, and release builds.
Google Play Console HelpUse Play App SigningHow Google protects an app-signing key and uses a separate upload key.
Android DevelopersVerify APK signaturesOfficial apksigner syntax for verifying APKs and printing certificate details.
DefractShield
Ready to verify your signing path?
Open the profile and compare its APK signer, distribution channel, and uploaded certificate before submission.
Choose a profile