Can't upload updated APK to Google Play due to different certificate

This question already has an answer here:

  • The apk must be signed with the same certificates as the previous version

    7 answers

  • Going to home screen programmatically
  • Best Way: Save & Restore TextView Position in ScrollView
  • How many Android devices do I need for thorough testing?
  • Android - getting from a Uri to an InputStream to a byte array?
  • Emulator's Location simulation not working
  • Android detect Bluetooth disconnect immediately Max 2 seconds
  • What is The use of moveToFirst () in SQLite Cursors
  • ActionBar Sherlock Menu Item OnClick
  • Detect and handle needing to login for wifi
  • Android: Is it possible to display video thumbnails?
  • When should I use ACCESS_COARSE_LOCATION permission?
  • SCAN_RESULTS_AVAILABLE_ACTION return empty list in Android 6.0
  • One Solution collect form web for “Can't upload updated APK to Google Play due to different certificate”

    Firstly, it’s unlikely that Google Play is wrong here. Are you sure you didn’t use your debug key by mistake?

    Check the signing keys used

    You should double-check which certificates the old APK and new APK contain, with the commands:

    jarsigner -verify -verbose:summary -certs old.apk
    jarsigner -verify -verbose:summary -certs new.apk

    This shows you information about the files signed in each APK, like this:

    sm  4642892 Thu Apr 17 10:57:44 CEST 2014 classes.dex (and 412 more)
        X.509, CN=My App, O=My Company, C=DE, L=Köln
        [certificate is valid from 11/11/13 12:12 to 29/03/41 12:12]
        [CertPath not validated: Path does not chain with any of the trust anchors]

    If the new APK says X.509, CN=Android Debug, O=Android, C=US, then you have signed the APK with your debug key instead of the original release key.

    If the X.509 identity strings are otherwise different, or the certificate dates are different between the two APKs, you’ve just confirmed that you did not use the same signing key for both APKs.

    You can ignore any “CertPath not validated” message; it’s not relevant in this case.

    Search for the original keystore

    If the certificate information is different, you need to find the original keystore, i.e. the file with the first SHA1 value that Google Play told you.

    Search through all the keystore files you can find until you have the one with the correct SHA1 fingerprint:

    keytool -list -keystore my-release.keystore

    I can’t find the original keystore

    If you cannot find the original keystore, you will never be able to publish any updates to this particular app.

    Android mentions this explicitly on the Signing Your Application page:

    Warning: Keep your keystore and private key in a safe and secure place, and ensure that you have secure backups of them. If you publish an app to Google Play and then lose the key with which you signed your app, you will not be able to publish any updates to your app, since you must always sign all versions of your app with the same key.

    After the first release of an APK, all subsequent releases must be signed with the exact same key.

    Can I extract the original signing key from the original APK?

    No. This is not possible. The APK only contains public information, and not your private key information.

    Can I migrate to a new signing key?

    No. Even if you do find the original, you can’t sign an APK with key A, then sign the next update with both keys A and B, then sign the next update with only key B.

    Signing an APK (or any JAR file) with multiple keys technically possible, but Google Play does not accept APKs with multiple signatures.

    What can I do?

    You will have to build your app with a new application ID (e.g. change from “com.example.myapp” to “com.example.myapp2”) and create a brand new listing on Google Play.

    Possibly you will also have to change your code so that people can install the new app even if they have the old app installed, e.g. you need to make sure that you don’t have conflicting content providers.

    You will lose your existing install base, reviews etc., and will have to find a way to get your existing customers to uninstall the old app and install the new version.

    Again, ensure you have backups of the keystore and password you use for this version.

    Android Babe is a Google Android Fan, All about Android Phones, Android Wear, Android Dev and Android Games Apps and so on.