I have downloaded the signal app from https://signal.org/android/apk/. To verify the download, there is a fingerprint provided. But how can I verify this fingerprint with the file? I know that I can use sha256sum to verify a hash, but do I need a certificate or something similar for a fingerprint?
Log in to share your answer and help other learners.
Log in to answerBest Answer · By JanBask Cyber Security Expert
Ankur Vaish JanBask Expert
Answered on Feb 8, 2022
You've missed a key word in the download page: You can verify the signing certificate on the APK matches this SHA256 fingerprint
(emphasis mine) APK files are just ZIP files in reality, so open it up with whatever archive tool you want (I use 7zip) and extract META-INFCERT.RSA from it. You can then verify that the certificate fingerprint matches what is written on the site. Note that this isn't the same as the hash of the whole certificate either! You'll need to use keytool to check it. The keytool binary is included in the Java JDK (usually in the %ProgramFiles%Javajdk_in directory), and can be used as follows:
keytool -printcert -file X:PathToCERT.RSA
Output looks like this:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 16:24:42 BST 2010 until: Tue May 16 16:24:42 BST 2045
Certificate fingerprints:
MD5: D9:0D:B3:64:E3:2F:A3:A7:BD:A4:C2:90:FB:65:E3:10
SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA Version: 3
You can see that the SHA256 fingerprint matches what we saw on the site. Once you've verified this you can go ahead and install the APK onto your Android device. Since you've verified that the signing certificate inside the APK matches the one that Signal expects you to see, you can then rely upon the Android operating system to validate that the APK is properly signed - it won't allow you to load it otherwise.
Ranjana Admin JanBask Expert Latest answer
Answered on Jul 4, 2024
To verify the SHA256 fingerprint of an APK file, you can follow these steps:
Download the APK file that you want to verify.
Get the SHA256 hash of the APK file. You can do this using various tools depending on your operating system.
On Windows:
Open a Command Prompt.
Navigate to the directory where your APK file is located.
Run the following command:
certutil -hashfile your_apk_file.apk SHA256 Replace your_apk_file.apk with the actual file name of your APK.On macOS and Linux:Open a Terminal.Navigate to the directory where your APK file is located.
Run the following command:
shasum -a 256 your_apk_file.apkReplace your_apk_file.apk with the actual file name of your APK.Using OpenSSL (cross-platform):Open a Terminal or Command Prompt.
Navigate to the directory where your APK file is located.
Run the following command:openssl dgst -sha256 your_apk_file.apkReplace your_apk_file.apk with the actual file name of your APK.
Compare the SHA256 Hash:After running one of the above commands, you will get a SHA256 hash value. Compare this value with the SHA256 hash provided by the source from where you downloaded the APK. If the values match, the APK file is verified.
If you need any further assistance with these steps, please let me know!
Ranjana Admin JanBask Expert
Answered on Jul 4, 2024
To verify the SHA256 fingerprint of an APK file, you can follow these steps:
Download the APK file that you want to verify.
Get the SHA256 hash of the APK file. You can do this using various tools depending on your operating system.
On Windows:
Open a Command Prompt.
Navigate to the directory where your APK file is located.
Run the following command:
certutil -hashfile your_apk_file.apk SHA256 Replace your_apk_file.apk with the actual file name of your APK.On macOS and Linux:Open a Terminal.Navigate to the directory where your APK file is located.
Run the following command:
shasum -a 256 your_apk_file.apkReplace your_apk_file.apk with the actual file name of your APK.Using OpenSSL (cross-platform):Open a Terminal or Command Prompt.
Navigate to the directory where your APK file is located.
Run the following command:openssl dgst -sha256 your_apk_file.apkReplace your_apk_file.apk with the actual file name of your APK.
Compare the SHA256 Hash:After running one of the above commands, you will get a SHA256 hash value. Compare this value with the SHA256 hash provided by the source from where you downloaded the APK. If the values match, the APK file is verified.
If you need any further assistance with these steps, please let me know!
Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.
Step-by-step Cyber Security guides from industry experts
Common Cyber Security interview questions, answered
Guides, tips and career advice on Cyber Security from JanBask experts.
Cyber Security Prepare with 100 Cyber Security Interview Questions & Answers
Boost your interview confidence learn answers to 101 common cybersecurity questions, from basics to advanced techniques.
Cyber Security AI in Cybersecurity: The Double-Edged Sword
Explore how AI is reshaping cybersecurity as a double-edged sword. Learn how attackers use AI for sophisticated threats and how…
Cyber Security Exploring the Advantages and Disadvantages of Ethical Hacking
Discover the key advantages and disadvantages of ethical hacking from enhancing security and regulatory compliance to potential…
Cyber Security Top Cyber Security Projects Ideas to Consider in 2025
Explore 19 practical cybersecurity project ideas for 2025, from AI threat detection to honeypots. Build skills, boost your…