Android App Bundle upload failed: "not signed with the upload certificate" error

TL;DR

Re-sign the bundle with the upload key that Play App Signing expects, or reset the upload key if the original is lost. Download the upload certificate fingerprint from Play Console and compare it with your keystore fingerprint; they must match. If your CI signs with the final app signing key or an old keystore instead, point the release signing configuration at the upload keystore and rebuild.

not signed with the upload certificate - Android App Bundle

Use this when

• Play Console rejects the AAB saying it is not signed with the upload certificate.
• Signing moved to a new CI system or a new keystore was generated.
• The app is enrolled in Play App Signing, which is required for bundles.

Not for this skill when

• The app is not yet enrolled in Play App Signing. Enrolment is the first step, with its own flow.
• The error names the app signing certificate itself. Upload key and signing key are different roles; do not confuse them.

Steps

1. In Play Console, open Setup, App signing, and copy the SHA-1 or SHA-256 fingerprint of the upload certificate. Verify: the expected upload certificate fingerprint is recorded
2. Print the fingerprint of the keystore your build uses with the keytool list command. Verify: your keystore fingerprint is printed from the actual file CI uses
3. Compare the two fingerprints exactly. Verify: they match, meaning the wrong artefact was uploaded, or they differ, meaning the build signs with the wrong key
4. Point the release signing configuration at the correct upload keystore, keeping its credentials in CI secret storage rather than in the repository. Verify: the build file references the upload keystore path supplied by CI
5. Rebuild the bundle and verify its signer with the apksigner or bundletool validation output. Verify: the bundle signer fingerprint equals the Console upload certificate fingerprint
6. Upload again; if the correct key is lost, use the Console upload key reset flow with a new key instead of repeating uploads. Verify: Console accepts the bundle, or a reset request is submitted with the new certificate
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Play App Signing splits two roles: Google holds the final app signing key, and your upload key only proves the upload comes from you. Any keystore can sign a bundle locally, so the mistake is silent until Play compares fingerprints. New keystores created during CI migrations are the usual cause, followed by signing with the extracted app signing key by mistake.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

AAB not signed with upload certificate Play Console

Console phrasing; compare fingerprints first. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

upload key mismatch Android App Bundle fix

Key-focused phrasing; fix the signing configuration or reset the upload key. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: keystore with multiple aliases

A keystore can hold several keys. Ensure the alias in the signing configuration is the upload key alias, not an older one. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstsYg4JhCQrivhqsf5g1xsQ