Skip to content

Commit 6763e9b

Browse files
DaveMeadAdjustDaveMeadAdjust
committed
Add retrieve fingerprints page and consolidate
1 parent 4e1b513 commit 6763e9b

11 files changed

+400
-444
lines changed

‎src/content/docs/en/sdk/android/v4/integrations/retrieve-certificate-fingerprints.mdx

+194
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
title: Retrieve Android certificate fingerprints
3+
description: Retrieve Android certificate fingerprints to configure Adjust features
4+
slug: en/sdk/android/v4/integrations/retrieve-certificate-fingerprints
5+
versions:
6+
- label: v5
7+
value: v5
8+
default: true
9+
- label: v4
10+
value: v4
11+
redirects:
12+
v5: /en/sdk/android/integrations/retrieve-certificate-fingerprints
13+
---
14+
15+
A certificate fingerprint is a cryptographic hash of the public information held within a certificate. As described in [Google's documentation](https://developer.android.com/studio/publish/app-signing#api-providers), certificate fingerprints are public information designed to be used by third-parties for Android app verification. Adjust never requests private app signing keys.
16+
17+
Adjust uses certificate fingerprints for the following features:
18+
19+
| Feature | Hashing algorithm | Example |
20+
| ---------------------------------------------------------------------------------------------------- | ----------------- | ----------------------------------------------------------------------------------------------- |
21+
| [SDK Signature](https://help.adjust.com/en/article/sdk-signature#add-signatures-in-the-adjust-suite) | SHA-1 | C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5 |
22+
| [Android App Links](https://help.adjust.com/en/article/set-up-android-app-links#set-up-in-appview) | SHA-256 | 55:FB:97:0F:46:0F:94:EC:07:EA:01:69:50:5A:20:3F:A0:91:60:A4:F1:33:58:EA:76:DC:54:9E:A7:6A:B9:1A |
23+
24+
Check the table below for the best way to get certificate fingerprints based on your app's distribution methods. When configuring the Adjust dashboard, be sure to add all certificate fingerprints that are applicable for your builds.
25+
26+
| Hosting service | Recommended approach |
27+
| ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
28+
| Google Play | [Google Play Console](#from-google-play-console) |
29+
| Google Play test track | [Google Play Console - Internal app sharing](#from-google-play-console---internal-app-sharing) |
30+
| Huawei AppGallery - App Signing Enabled | [AppGallery Connect](#from-appgallery-connect) |
31+
| • Huawei AppGallery - App Signing Disabled <br />• Other store, or direct APK download <br />• Local debug build | [Keystore](#from-a-keystore) or [APK](#from-an-apk) |
32+
33+
#### From Google Play Console {#from-google-play-console}
34+
35+
<Callout type="note">
36+
If both the **App signing key certificate** and **Upload key certificate**
37+
sections are present, then you have to retrieve and configure certificate
38+
fingerprints for both in the Adjust dashboard.
39+
</Callout>
40+
41+
1. In [Google Play Console](https://play.google.com/console), go to your app.
42+
2. On the menu on the left side, select **Test and release** > select **Setup** > **App signing**.
43+
3. If you're using Play App Signing, the **App signing key certificate** section will be present. In this section, copy the **SHA-1 certificate fingerprint** and/or **SHA-256 certificate fingerprint**.
44+
45+
![Screenshot of the app signing key certificate page in Google Play Console](@images/sig-v3/google-play-app-signing.png)
46+
47+
4. Under **Upload key certificate**, copy the **SHA-1 certificate fingerprint** and/or **SHA-256 certificate fingerprint**.
48+
49+
![Screenshot of the upload key certificate page in Google Play Console](@images/sig-v3/google-play-upload.png)
50+
51+
#### From Google Play Console - Internal app sharing {#from-google-play-console---internal-app-sharing}
52+
53+
1. In [Google Play Console](https://play.google.com/console), go to your app.
54+
2. On the menu on the left side, select **Test and release** > select **Testing** > **Internal app sharing**.
55+
3. Under **Internal test certificate**, copy the **SHA-1 certificate fingerprint** and/or **SHA-256 certificate fingerprint**.
56+
57+
![Screenshot of the internal app sharing key certificate page in Google Play Console](@images/sig-v3/google-play-internal-app-sharing.png)
58+
59+
#### From AppGallery Connect {#from-appgallery-connect}
60+
61+
If you use Huawei App Signing, follow the below instructions. If you don't use Huawei App Signing, retrieve your certificate fingerprints [from a keystore](#from-a-keystore) or [from an APK](#from-an-apk).
62+
63+
<Callout type="note">
64+
Retrieve and configure certificate fingerprints in the Adjust dashboard for
65+
both the **App Signature Certificate** and **Upload Certificate**.
66+
</Callout>
67+
68+
<Tabs>
69+
<Tab title="SHA-1" sync="sha-1">
70+
1. In [AppGallery Connect](https://developer.huawei.com/consumer/en/service/josp/agc/index.html), select **My Apps**.
71+
2. Select your app.
72+
3. Under **Services**, go to **App Signing**.
73+
4. Under **App Signature Certificate** and **Upload Certificate**, respectively, select **Download Certificate**.
74+
75+
![Screenshot of the certificate page in Huawei AppGallery](@images/sig-v3/huawei-sha1.png)
76+
77+
5. If needed, install OpenSSL:
78+
79+
- macOS: `brew install openssl`
80+
- Linux: Usually pre-installed or use your package manager
81+
- Windows: Use Microsoft's vcpkg package manager or Windows Subsystem for Linux (WSL)
82+
83+
6. Run the below `openssl` command on each certificate file `<certificate.pem>`:
84+
85+
```bash
86+
openssl x509 -fingerprint -in <certificate.pem> -noout -SHA1
87+
```
88+
89+
7. Retrieve each SHA1 from the output:
90+
91+
```
92+
SHA1 Fingerprint=C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5
93+
```
94+
95+
</Tab>
96+
<Tab title="SHA-256" sync="sha-256">
97+
1. In [AppGallery Connect](https://developer.huawei.com/consumer/en/service/josp/agc/index.html), select **My Apps**.
98+
2. Select your app.
99+
3. Under **Services**, go to **App Signing**.
100+
4. Under **App Signature Certificate** and **Upload Certificate**, respectively, copy each SHA-256 certificate fingerprint.
101+
102+
![Screenshot of the certificate page in Huawei AppGallery](@images/sig-v3/huawei-sha256.png)
103+
104+
</Tab>
105+
</Tabs>
106+
107+
#### From a keystore {#from-a-keystore}
108+
109+
<Callout type="note">
110+
- The below steps require Java to be installed. - If you sign your app with
111+
the Android default debug keystore, you don’t need to configure the
112+
certificate fingerprint in the Adjust dashboard for SDK Signature. However,
113+
you do need to configure it for Android App Links.
114+
</Callout>
115+
116+
To retrieve certificate fingerprints from your keystore, follow these steps:
117+
118+
1. Locate your keystore:
119+
- Self-managed keystore: path to the folder containing your .jks file
120+
- Android default debug keystore:
121+
- macOS/Linux: `~/.android/debug.keystore`
122+
- Windows: `%USERPROFILE%\.android\debug.keystore`
123+
2. Run the below `keytool` command, replacing the parameter values:
124+
125+
```bash
126+
# For a self-managed keystore (replace with path to your .jks file):
127+
keytool -list -v -keystore </path/to/keystore.jks> -alias <your_key_alias>
128+
129+
# For the Android default debug keystore:
130+
keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey
131+
```
132+
133+
3. When prompted for the password, do the following:
134+
- For a self-managed keystore, enter the password you set during keystore generation.
135+
- For the Android default debug keystore, enter `android`.
136+
4. Retrieve the SHA1 and/or SHA256 values from the output:
137+
138+
```
139+
[...]
140+
141+
SHA1: C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5
142+
SHA256: 55:FB:97:0F:46:0F:94:EC:07:EA:01:69:50:5A:20:3F:A0:91:60:A4:F1:33:58:EA:76:DC:54:9E:A7:6A:B9:1A
143+
144+
[...]
145+
```
146+
147+
#### From an APK {#from-an-apk}
148+
149+
To retrieve certificate fingerprints used to sign your APK, follow these steps:
150+
151+
1. If needed, install [Android Studio](https://developer.android.com/studio) to get the [apksigner](https://developer.android.com/tools/apksigner) command.
152+
- During Android Studio installation, ensure the Android SDK is installed (it's included by default).
153+
- The Android SDK build-tools will be installed in the below locations:
154+
- macOS/Linux: `~/Library/Android/sdk/build-tools/<version>/`
155+
- Windows: `%LOCALAPPDATA%\Android\Sdk\build-tools\<version>\`
156+
2. Run the below `apksigner` command, replacing the parameter value:
157+
```bash
158+
apksigner verify -v --print-certs <app.apk>
159+
```
160+
3. Retrieve the SHA-1 and/or SHA-256 values from the output. Apps may show a single signature:
161+
162+
```
163+
[...]
164+
165+
Signer #1 certificate SHA-1 digest: c4bd0791bc09f8b615cdbca33fbc688bc2ef4ff5
166+
Signer #1 certificate SHA-256 digest: 55fb970f460f94ec07ea0169505a203fa09160a4f13358ea76dc549ea76ab91a
167+
168+
[...]
169+
```
170+
171+
Or multiple signatures:
172+
173+
```
174+
[...]
175+
176+
Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-1 digest: c4bd0791bc09f8b615cdbca33fbc688bc2ef4ff5
177+
Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-256 digest: 55fb970f460f94ec07ea0169505a203fa09160a4f13358ea76dc549ea76ab91a
178+
179+
[...]
180+
181+
Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-1 digest: 9a3237ad99a97e8ea72df4fb096f28d544d5b8
182+
Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-256 digest: 92e961bf8b67043d1af6061b4a926f6a94e2bb78b46a096639e8e2c2fb7784b0
183+
184+
[...]
185+
```
186+
187+
If multiple signatures are present, you'll need to configure all of them in the Adjust dashboard.
188+
189+
<Callout type="note">
190+
The Adjust dashboard requires SHA-256 certificate fingerprints for Android
191+
App Links to be entered with colons separating each pair of characters (for
192+
example:
193+
55:fb:97:0f:46:0f:94:ec:07:ea:01:69:50:5a:20:3f:a0:91:60:a4:f1:33:58:ea:76:dc:54:9e:a7:6a:b9:1a).
194+
</Callout>

‎src/content/docs/en/sdk/android/v4/integrations/signature-library.mdx

+3-111
Original file line numberDiff line numberDiff line change
@@ -122,122 +122,14 @@ The Signature library can’t verify the authenticity of your certificate finger
122122

123123
You must add the fingerprints of your signing certificates to the allowlist. If no fingerprints are added to the allowlist, traffic from your app can be spoofed.
124124

125-
</Callout>
126-
127-
#### From a keystore {#from-a-keystore}
128-
129-
If you use your own keystore, or if Android Studio generated a keystore for you, you can retrieve the certificate fingerprint by following these steps:
130-
131-
1. Find the keystore file (`.jks`) you used to sign **the release version of your app**. The keystore must be the one you used to sign the release version sent to the Google Play Store. If the keystore is different, your SDK requests will be rejected.
132-
2. Run the following command to list your keys. Replace the parts in angle brackets with your information.
133-
134-
```console
135-
$ keytool -list -v -keystore <path/to/keystore.jks> -alias <your_key_alias>
136-
```
137-
138-
This command prompts you for your keystore password. This is the password you defined when you generated the keystore.
139-
140-
The final output looks like this:
141-
142-
```text
143-
Alias name: Key0
144-
Creation date: May 15, 2018
145-
Entry type: PrivateKeyEntry
146-
Certificate chain length: 1
147-
Certificate[1]:
148-
Owner: CN=[Adjust, GmbH.]
149-
Issuer: CN=[Adjust, GmbH.]
150-
Serial number: 642f1b62
151-
Valid from: Tue May 15 09:46:06 CEST 2018 until: Sat May 09
152-
09:46:06 CEST 2043
153-
Certificate fingerprints:
154-
MD5: E7:88:9F:8C:9D:F4:14:C1:CF:E8:4C:97:F3:F2:3A:E3
155-
SHA1:
156-
C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5
157-
SHA256:
158-
55:FB:97:0F:46:0F:94:EC:07:EA:01:69:50:5A:20:3F:A0:91:60:A4:F
159-
1:33:58:EA:76:DC:54:9E:A7:6A:B9:1A
160-
Signature algorithm name: SHA256withRSA
161-
Subject Public Key Algorithm: 2048-bit RSA key
162-
Version: 3
163-
```
164-
165-
3. Save the SHA-1 fingerprint to [add to your allowlist in the Adjust Suite](#add-your-digital-certificate-fingerprints-to-adjusts-allowlist).
166-
167-
#### From Google Play Internal App Sharing {#from-google-play-internal-app-sharing}
168-
169-
If you use [Google Play Internal App Sharing](https://support.google.com/googleplay/android-developer/answer/9303479?hl=en), you need to send both your organization’s SHA-1 certificate fingerprint and your Internal test certificate fingerprint to Adjust for allowlisting.
170-
171-
To extract the fingerprints:
172-
173-
1. Navigate to the Google Play Console and log in.
174-
2. Select your app.
175-
3. Select **Release Management --> App Releases --> Manage internal app sharing > App certificates**.
176-
4. Save the **SHA-1 certificate fingerprint** for both the **Internal test certificate** and your organization’s keystore to [add to your allowlist in the Adjust Suite](#add-your-digital-certificate-fingerprints-to-adjusts-allowlist).
177-
178-
![A screenshot of the certficate page in Google Play Console](@images/sig-v3/google-play-internal-sharing.png)
179-
180-
#### From Google Play App Signing {#from-google-play-app-signing}
181-
182-
If you use [Google Play App Signing](https://support.google.com/googleplay/android-developer/answer/7384423?hl=en), you need to send both your organization’s SHA-1 certificate fingerprint and your Internal test certificate fingerprint to Adjust for allowlisting.
183-
184-
To extract the fingerprints:
185-
186-
1. Navigate to the Google Play Console and log in.
187-
2. Select your app.
188-
3. Select **Release Management > App Signing**.
189-
4. Save the **SHA-1 certificate fingerprint** for both the **App signing certificate** and **Upload certificate** to send to Adjust.
190-
191-
![A screenshot of the App signing page in the Google Play Console](@images/sig-v3/google-play-signing.png)
192-
193-
#### From Huawei AppGallery App Signing {#from-huawei-appgallery-app-signing}
194-
195-
If you use Huawei AppGallery App Signing, you need to send both your organization’s SHA-1 certificate fingerprint and your Internal test certificate fingerprint to Adjust for allowlisting.
196-
197-
<Callout type="note">
198-
199-
If you use your own signing certificate with Huawei AppGallery, follow the [instructions for retrieving your certificate fingerprint from a keystore](#from-a-keystore).
200-
201-
</Callout>
202-
203-
To extract the fingerprints:
204-
205-
1. Navigate to the App Signing page in AppGallery Connect and download the App signing certificate (`certificate.pem`).
206-
207-
![A screenshot of the App Signing page in AppGallery Connect](@images/sig-v3/huawei-appgallery-signing.png)
208-
209-
2. Once you’ve downloaded the certificate, run the following command to output the SHA-1 fingerprint of the certificate.
210-
211-
```console
212-
$ openssl x509 -fingerprint -in certificate.pem -noout -SHA1
213-
```
214-
215-
The output looks like this:
216-
217-
```text
218-
SHA1 Fingerprint=C4:BD:07:91:BC:09:F8:B6:15:CD:BC:A3:3F:BC:68:8B:C2:EF:4F:F5
219-
```
220-
221-
3. Save the fingerprint to [add to your allowlist in the Adjust Suite](#add-your-digital-certificate-fingerprints-to-adjusts-allowlist)..
222-
223-
### Add your digital certificate fingerprints to Adjust’s allowlist {#add-your-digital-certificate-fingerprints-to-adjust-s-allowlist}
224-
225-
<Callout type="note">
226-
227125
Remember to add all certificate fingerprints you want to use to the Adjust suite. This might include debug versions and versions for different stores.
228126

229127
</Callout>
230128

231-
Once you’ve obtained your certificate fingerprints, do the following to add them to your allowlist:
232-
233-
1. Select your app in AppView to open the app details screen.
234-
2. Select the **Protection** tab.
235-
3. Select the **Edit** button on the **Suspicious installs** section.
236-
4. Under the **Android fingerprinting** section, select **New fingerprint**.
237-
5. Paste the SHA-1 fingerprint into the text box that appears.
238-
6. Select **Add**.
129+
Follow these steps to retrieve and configure your certificate fingerprints:
239130

240-
That’s it! Your fingerprint is now allowlisted for your app.
131+
1. [Retrieve Android certificate fingerprints](/en/sdk/android/integrations/retrieve-certificate-fingerprints)
132+
2. [Configure them in the Adjust dashboard](https://help.adjust.com/en/article/sdk-signature#add-signatures-in-the-adjust-suite)
241133

242134
## Test your app {#test-your-app}
243135

0 commit comments

Comments
 (0)