Play: signed with the wrong key

Error text

Your Android App Bundle is signed with the wrong key. Ensure that your App Bundle is signed with the correct signing key and try again.
SHA1 of the certificate you used: AA:BB:...  Expected: CC:DD:...

Cause

Play Console says the certificate of the uploaded AAB does not match the upload key registered earlier.

Step-by-step fix

1. On the App integrity page in Play Console find the expected SHA1 fingerprint.
2. Extract the SHA1 of your own keystore with keytool -list -v and compare.
3. If they differ, point the signing config in build.gradle at the right keystore and alias.
4. If the key is lost, ask for App integrity > Request upload key reset.
5. After you get the new key, rebuild the AAB and upload again.

Example commands

keytool -list -v -keystore release.jks -alias release | grep SHA1
./gradlew signingReport
bundletool dump manifest --bundle app.aab

How to prevent it

Write down the upload key and its fingerprint, and keep CI variables secret.

Author and license: Nibras Code