Certificate fingerprint error

Check whether the appid is the same as the appid on AppGalleryConnect. Check your configuration carefully. In addition, check the certificate fingerprint. Ensure that the JSON file is stored in the project-level directory instead of the application-level directory, check the following items configuration process carefully.

1.Check whether the fingerprint certificate is correctly configured when you apply for related services.
Open the APK file of an app, extract the META-INF directory from the file, obtain the CERT.RSA file in the directory, and run the keytool -printcert -file META-INF/CERT.RSA command to print the signature certificate information.

2.HMS Core (APK) will cache the signature file. You need to find HMS Core (APK) on the Apps page of your device and clear its cache, restart your app, and perform the previous operation again.

3.Sign in to AppGallery Connect, click My apps. On the page that is displayed, go to Develop > Project settings > conventional, check whether SHA-256 certificate fingerprint is consistent with the fingerprint in step 1.

4.For third-party access, check the value of appid.

<meta-data android:name="com.huawei.hms.client.appid" android:value="Your appid"/> 

or

<meta-data android:name="com.huawei.hms.client.appid" android:value="appid=Your appid"/>

Also you’re advised to upgrade the SDK.

Hope this could help with your issue.

The four hash values you see are SPKI hashes. While the fingerprint you see when looking at the certificate is computed over the whole certificate the SPKI hash is only computed over the SubjectPublicKeyInfo, i.e. the public key contained in the certificate. See Mozilla:HPKP for more details including ways to compute the SPKI hash using common tools.

Apart from that these SPKI hashes do not necessarily specify the leaf certificate (i.e. the one you were looking at). Instead at least one of the SPKI hashes for a site should match one of the certificates in the certificate chain, i.e. from leaf up to and including the locally trusted root certificate. This matches the behavior of the HPKP header which is described in RFC 7469 as follows:

… compute the SPKI Fingerprints for each certificate in the Pinned Host’s validated certificate chain … check that the set of these SPKI
Fingerprints intersects the set of SPKI Fingerprints in that Pinned
Host’s Pinning Metadata

To manually do the checks one might export every certificate from the browser, compute the SPKI hash (see first link on how to do this) and then check if it is in the list of preloaded SPKI hashes. For the connection I get to www.google.com I get the following chain (note that I get a different leaf certificate):

[0] www.google.com
cert fingerprint: 27:4C:3B:05:9F:30:5C:C3:C7:EE:23:98:E5:33:21:EE:56:34:E0:40:96:09:1E:87:BE:F0:9D:AF:A7:44:39:12
SPKI hash: He1hxIXPpsnamgIS9IH1HC45P2yj45Py1fi0/JI6JBo=

[1] Google Internet Authority G3
cert fingerprint: BE:0C:CD:54:D4:CE:CD:A1:BD:5E:5D:9E:CC:85:A0:4C:2C:1F:93:A5:22:0D:77:FD:E8:8F:E9:AD:08:1F:64:1B
SPKI hash: f8NnEFZxQ4ExFOhSN7EiFWtiudZQVD2oY60uauV/n78=

[builtin] GlobalSign Root CA - R2
cert fingerprint: CA:42:DD:41:74:5F:D0:B8:1E:B9:02:36:2C:F9:D8:BF:71:9D:A1:BD:1B:1E:FC:94:6F:5B:4C:99:F4:2C:1B:9E
SPKI hash: iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0=

As you can see, the last SPKI hash from the builtin root CA intersects with the preloaded SPKI hashes which means that the validation was successful.

If you want to know what the other SPKI hashes are for you might have a look at the source code for Chromium where it shows the following definition for the PIN set used for the Google domains:

  "name": "google",
  "static_spki_hashes": [
    "GoogleBackup2048",
    "GoogleG2",
    "GeoTrustGlobal",
    "GlobalSignRootCA_R2"
  ],

The last item GlobalSignRootCA_R2 is the one found in the current chain.

Hello,

Today, while I’m trying to update the app that was earlier published in January 2016, I’m getting the below mentioned error. Kindly request your help at the earliest to get this address. Below is the error message that I’m getting;

Upload failed

You uploaded an APK that is signed with a different certificate to your previous APKs. You must use the same certificate. Your existing APKs are signed with the certificate(s) with fingerprint(s):

[ SHA1: 3B:F0:E3:9C:92:16:5F:1F:5B:5D:5B:3A:0F:A3:C7:D4:29:67:AA:11 ]

and the certificate(s) used to sign the APK you uploaded have fingerprint(s):

[ SHA1: EF:F0:80:99:A1:AB:38:D2:CE:BC:60:32:48:11:AC:1A:AE:61:EB:E3 ]

Earlier, this app was published using a personal ID and that got the certificate migrated to official email ID: android.rxprism@gmail.com by sending a request email to: html5tools@intel.com. Currently when I try to import, it shows there is no legacy certificate as well.

This app is due to submission for an event and I’m not sure how to overcome this challenge. Can someone kindly help me on this please.