Add retrieve fingerprints page and consolidate - Android SDK #1266
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,195 @@ | ||
| --- | ||
| title: Retrieve Android certificate fingerprints | ||
| description: Retrieve Android certificate fingerprints to configure Adjust features | ||
| slug: en/sdk/android/v4/integrations/retrieve-certificate-fingerprints | ||
| versions: | ||
| - label: v5 | ||
| value: v5 | ||
| default: true | ||
| - label: v4 | ||
| value: v4 | ||
| redirects: | ||
| v5: /en/sdk/android/integrations/retrieve-certificate-fingerprints | ||
| --- | ||
|
|
||
| A certificate fingerprint is a cryptographic hash of the public information held within a certificate. As described in [Google's documentation](https://developer.android.com/studio/publish/app-signing#api-providers), certificate fingerprints are public information designed to be used by third-parties for Android app verification. Adjust never requests private app signing keys. | ||
|
|
||
| Adjust uses certificate fingerprints for the following features: | ||
|
|
||
| | Feature | Hashing algorithm | Example | | ||
| | ---------------------------------------------------------------------------------------------------- | ----------------- | ----------------------------------------------------------------------------------------------- | | ||
| | [SDK Signature](https://help.adjust.com/en/article/sdk-signature#add-signatures-in-the-adjust-suite) | SHA-1 | C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5 | | ||
| | [Android App Links](https://help.adjust.com/en/article/set-up-android-app-links#set-up-in-appview) | SHA-256 | 55:FB:97:0F:46:0F:94:EC:07:EA:01:69:50:5A:20:3F:A0:91:60:A4:F1:33:58:EA:76:DC:54:9E:A7:6A:B9:1A | | ||
|
|
||
| Check the table below for the best way to get certificate fingerprints based on your app's distribution methods. When configuring the Adjust dashboard, be sure to add all certificate fingerprints that are applicable for your builds. | ||
|
|
||
| | Hosting service | Recommended approach | | ||
| | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | ||
| | Google Play | [Google Play Console](#from-google-play-console) | | ||
| | Google Play test track | [Google Play Console - Internal app sharing](#from-google-play-console---internal-app-sharing) | | ||
| | Huawei AppGallery - App Signing Enabled | [AppGallery Connect](#from-appgallery-connect) | | ||
| | • Huawei AppGallery - App Signing Disabled <br />• Other store, or direct APK download <br />• Local debug build | [Keystore](#from-a-keystore) or [APK](#from-an-apk) | | ||
|
|
||
| #### From Google Play Console {#from-google-play-console} | ||
|
|
||
|
There was a problem hiding this comment. I suggest adding an initial sentence explaining that both the signing key certificate fingerprint and the upload key certificate fingerprint may be required. Otherwise, steps 3 and 4 may be confusing. |
||
| 1. In [Google Play Console](https://play.google.com/console), go to your app. | ||
| 2. Under **Release**, go to **Setup > App signing**. | ||
| 3. If you're using Play App Signing, the **App signing key certificate** section will be present. In this section, copy the **SHA-1 certificate fingerprint** and/or **SHA-256 certificate fingerprint**. | ||
|
|
||
|  | ||
|
|
||
| 4. Under **Upload key certificate**, copy the **SHA-1 certificate fingerprint** and/or **SHA-256 certificate fingerprint**. | ||
|
|
||
|  | ||
|
|
||
| #### From Google Play Console - Internal app sharing {#from-google-play-console---internal-app-sharing} | ||
|
|
||
|
There was a problem hiding this comment. Previously, we required the upload key certificate fingerprint for the internal app sharing case as well. In theory, it's not necessary, and it was asked simply because the old Google page layout had all certificates mixed together (just like in the previous case for release versions), making errors very common. Can you confirm that the |
||
| 1. In [Google Play Console](https://play.google.com/console), go to your app. | ||
| 2. Under **Release**, go to **Setup > Internal app sharing**. | ||
| 3. Under **Internal test certificate**, copy the **SHA-1 certificate fingerprint** and/or **SHA-256 certificate fingerprint**. | ||
|
|
||
|  | ||
|
|
||
| #### From AppGallery Connect {#from-appgallery-connect} | ||
|
|
||
| If you use Huawei App Signing, follow the below instructions. If you don't use Huawei App Signing, retrieve your certificate fingerprints [from a keystore](#from-a-keystore) or [from an APK](#from-an-apk). | ||
|
|
||
| <Tabs> | ||
| <Tab title="SHA-1" sync="sha-1"> | ||
| 1. In [AppGallery Connect](https://developer.huawei.com/consumer/en/service/josp/agc/index.html), select **My Apps**. | ||
|
Check warning on line 59 in src/content/docs/en/sdk/android/v4/integrations/retrieve-certificate-fingerprints.mdx
|
||
| 2. Select your app. | ||
| 3. Under **Services**, go to **App Signing**. | ||
| 4. Under **App Signature Certificate** and **Upload Certificate**, respectively, select **Download Certificate**. | ||
|
|
||
|  | ||
|
|
||
| 5. If needed, install openssl: | ||
|
There was a problem hiding this comment. Use "OpenSSL", to remain consistent with the official capitalisation when referring to the library by name. |
||
|
|
||
| - macOS: `brew install openssl` | ||
| - Linux: Usually pre-installed or use your package manager | ||
| - Windows: Download from the OpenSSL website or use Windows Subsystem for Linux (WSL) | ||
|
|
||
| 6. Run the below `openssl` command on each certificate file `<certificate.pem>`: | ||
|
|
||
| ```bash | ||
| openssl x509 -fingerprint -in <certificate.pem> -noout -SHA1 | ||
| ``` | ||
|
|
||
| 7. Retrieve each SHA1 from the output: | ||
|
|
||
| ``` | ||
| SHA1 Fingerprint=C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5 | ||
| ``` | ||
|
|
||
| </Tab> | ||
| <Tab title="SHA-256" sync="sha-256"> | ||
| 1. In [AppGallery Connect](https://developer.huawei.com/consumer/en/service/josp/agc/index.html), select **My Apps**. | ||
|
Check warning on line 86 in src/content/docs/en/sdk/android/v4/integrations/retrieve-certificate-fingerprints.mdx
|
||
| 2. Select your app. | ||
| 3. Under **Services**, go to **App Signing**. | ||
| 4. Under **App Signature Certificate** and **Upload Certificate**, respectively, copy each SHA-256 certificate fingerprint. | ||
|
|
||
|  | ||
|
|
||
| </Tab> | ||
| </Tabs> | ||
|
|
||
| #### From a keystore {#from-a-keystore} | ||
|
|
||
| To retrieve certificate fingerprints from your keystore, follow these steps: | ||
|
|
||
| 1. If needed, install [Android Studio](https://developer.android.com/studio) or Java Development Kit (JDK) to get the `keytool` command. | ||
|
There was a problem hiding this comment. JDK is not required, as Nitpick The chances that the development team who supposedly created an app doesn't have Android Studio or Java installed are negligible. I would suggest making this an inline observation rather than a full step in the description. Something like: "To retrieve certificate fingerprints from your keystore, follow these steps (Java is assumed to be installed):". A similar comment applies to the next section. |
||
| 2. Locate your keystore: | ||
| - Self-managed keystore: path to the folder containing your .jks file | ||
| - Android default debug keystore: | ||
|
There was a problem hiding this comment. The debug certificate fingerprints are not necessary anymore. I suggest removing this (and the corresponding commands below) to avoid any confusion. |
||
| - macOS/Linux: `~/.android/debug.keystore` | ||
| - Windows: `%USERPROFILE%\.android\debug.keystore` | ||
| 3. Run the below `keytool` command, replacing parameters as needed: | ||
|
|
||
| ```bash | ||
| # For self-managed keystore (replace with path to your .jks file): | ||
| keytool -list -v -keystore </path/to/keystore.jks> -alias <your_key_alias> | ||
|
|
||
| # For Android default debug keystore: | ||
| keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey | ||
| ``` | ||
|
|
||
| 4. When prompted for the password, do the following: | ||
| - For a self-managed keystore, enter the password you set during keystore generation. | ||
| - For Android default debug keystore, enter `android`. | ||
| 5. Retrieve the SHA1 and/or SHA256 values from the output: | ||
|
|
||
| ``` | ||
| [...] | ||
|
|
||
| SHA1: C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5 | ||
| SHA256: 55:FB:97:0F:46:0F:94:EC:07:EA:01:69:50:5A:20:3F:A0:91:60:A4:F1:33:58:EA:76:DC:54:9E:A7:6A:B9:1A | ||
|
|
||
| [...] | ||
| ``` | ||
|
|
||
| #### From an APK {#from-an-apk} | ||
|
Check warning on line 130 in src/content/docs/en/sdk/android/v4/integrations/retrieve-certificate-fingerprints.mdx
|
||
|
|
||
| To retrieve certificate fingerprints used to sign your APK, follow these steps: | ||
|
|
||
| 1. If needed, install [Android Studio](https://developer.android.com/studio) to get the [apksigner](https://developer.android.com/tools/apksigner) command. | ||
| - During Android Studio installation, ensure the Android SDK is installed (it's included by default). | ||
| - The Android SDK build-tools will be installed in the below locations: | ||
| - macOS/Linux: `~/Library/Android/sdk/build-tools/<version>/` | ||
| - Windows: `%LOCALAPPDATA%\Android\Sdk\build-tools\<version>\` | ||
| 2. Run the below `apksigner` command, replacing the parameter: | ||
| ```bash | ||
| apksigner verify -v --print-certs <app.apk> | ||
| ``` | ||
| 3. Retrieve the SHA-1 and/or SHA-256 values from the output. Apps may show a single signature: | ||
|
|
||
| ``` | ||
| [...] | ||
|
|
||
| Signer #1 certificate SHA-1 digest: c4bd0791bc09f8b615cdbca33fbc688bc2ef4ff5 | ||
| Signer #1 certificate SHA-256 digest: 55fb970f460f94ec07ea0169505a203fa09160a4f13358ea76dc549ea76ab91a | ||
|
|
||
| [...] | ||
| ``` | ||
|
|
||
| Or different signatures for different Android versions: | ||
|
There was a problem hiding this comment. There may be multiple signatures for the same version. I suggest removing "for different Android versions". |
||
|
|
||
| ``` | ||
| [...] | ||
|
|
||
| Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-1 digest: c4bd0791bc09f8b615cdbca33fbc688bc2ef4ff5 | ||
| Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-256 digest: 55fb970f460f94ec07ea0169505a203fa09160a4f13358ea76dc549ea76ab91a | ||
|
|
||
| [...] | ||
|
|
||
| Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-1 digest: 9a3237ad99a97e8ea72df4fb096f28d544d5b8 | ||
| Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-256 digest: 92e961bf8b67043d1af6061b4a926f6a94e2bb78b46a096639e8e2c2fb7784b0 | ||
|
|
||
| [...] | ||
| ``` | ||
|
|
||
| If multiple signatures are present, you'll need to configure all of them in the Adjust dashboard. | ||
|
|
||
| <Callout type="note"> | ||
| The Adjust dashboard requires SHA-256 certificate fingerprints to be entered | ||
| with colons separating each pair of characters (for example: | ||
| 55:fb:97:0f:46:0f:94:ec:07:ea:01:69:50:5a:20:3f:a0:91:60:a4:f1:33:58:ea:76:dc:54:9e:a7:6a:b9:1a). | ||
| </Callout> | ||
|
|
||
| ##### Extract APK from other formats {#extract-apk} | ||
|
Check warning on line 178 in src/content/docs/en/sdk/android/v4/integrations/retrieve-certificate-fingerprints.mdx
|
||
|
There was a problem hiding this comment. The XAPK format is not officially supported by Google, and requires a dedicated installer that often re-signs the app (e.g.: APK pure), which will cause the instructions here to fail. The AAB format also requires some post processing, such as uploading it to the Play Console and let it manage signing. The APKS format may be acceptable, but some research would need to be done before confidently marking it as supported. I am against listing any of these formats as officially supported by Adjust, at least when it comes to Signature, as they are non-standard ways of distributing apps, and the instructions here may not always be applicable. |
||
|
|
||
| If you have your app in a different format, you'll need to extract the APK first: | ||
|
|
||
| - **XAPK or APKs files**: Container formats that include APKs and additional files. | ||
|
|
||
| 1. Rename app.xapk or app.apks to app.zip. | ||
| 2. Extract the contents. | ||
| 3. Locate the base APK in the extracted contents (usually the largest APK file if there are multiple). | ||
| 4. Use the `apksigner` command above on the extracted APK. | ||
|
|
||
| - **AAB (Android App Bundle)**: A publishing format that contains APKs and resources. | ||
| 1. If needed, install the [bundletool](https://developer.android.com/tools/bundletool) command. | ||
| 2. Run the `bundletool` command to convert the AAB to APKs format, replacing the parameters: | ||
| ```bash | ||
| bundletool build-apks --bundle <app.aab> --output <app.apks> | ||
| ``` | ||
| 3. Follow the steps above for APKs files. | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggested changes in this file also apply in the v5 file.