An APK can have at least two SHA-256 values that developers casually call a “fingerprint.” The SHA-256 hash of the APK file identifies the exact bytes of that file. The SHA-256 digest of the signing certificate identifies the public certificate used to sign it. Android package registration checks use the certificate fingerprint, not the file hash.
Mixing them creates a frustrating failure mode: the value is valid hexadecimal, the length looks right, and the status check still cannot match the registered signing identity.
Extract the certificate from the final APK
Android's apksigner is the preferred artifact-aware tool because it understands modern APK signature schemes. Run it against the signed APK that will actually be distributed:
apksigner verify --print-certs app-release.apk
