This post is a bit of an aide-mémoire for myself. If you ever need to see which key signed an APK (for example to compare to a client ID in the API console when implementing Google+ Sign-In) you can actually extract the cert from the APK, and test it.
First you need to unzip the APK:
unzip ~/my-app.apk
You’re going to see a bunch of files extracted, including a CERT.RSA, which is usually in META-INF. If you use an alias for your key, it’ll be THAT-ALIAS.RSA.
inflating: META-INF/MANIFEST.MF
inflating: META-INF/CERT.SF
inflating: META-INF/CERT.RSA
You can then output the signatures for the certificate with the keytool app:
keytool -printcert -file META-INF/CERT.RSA
This will print out the various fingerprints, and let you know the details of the certificates owner - handy for checking whether it was accidentally signed with a debug key (which will look something like this):
Owner: CN=Android Debug, O=Android, C=US
Issuer: CN=Android Debug, O=Android, C=US
Serial number: 4f963ac8
Valid from: Wed Apr 27 12:43:33 BST 2012 until: Fri Apr 20 12:43:33 BST 2042
Certificate fingerprints:
MD5: 84:9E:5D:C5:2C:F5:1A:D5:29:B5:D1:28:DF:1A:6D:86
SHA1: 12:65:36:81:D2:8C:B3:7D:9E:48:55:66:DF:DD:1B:3D:6B:EC:E8:E9
Signature algorithm name: SHA1withRSA
Version: 3