# Bitwarden Android App Signing Key Mistake

**URL:** https://discuss.privacyguides.net/t/bitwarden-android-app-signing-key-mistake/17246
**Category:** General
**Tags:** software
**Created:** 2024-03-08T03:15:07Z
**Posts:** 3

## Post 1 by @Exuberant5915 — 2024-03-08T03:15:07Z

Tldr Bitwarden accidentally signed and released the fdroid version of their app with a debug cert. They have since rectified this error with a newer release signed with the correct pinned cert.

I use Obtainium to download and install new versions of Bitwarden from [Github](https://github.com/bitwarden/mobile/releases). (packageName com.x8bit.bitwarden)

Earlier today I couldn’t update the app with either the fdroid or regular release via either Obtainium or manual Github apk downloads. I grabbed the last 3 versions of each release (versionName 2024.2.1 2024.2.0 and 2024.1.1 )and inspected them with [com.apk.editor](https://github.com/apk-editor/APK-Explorer-Editor), and [apksigner](https://developer.android.com/tools/apksigner) and found that the fdroid and regular releases are signed by different certs. Which is fine and prevents accidentally migrating from one release to another.

The problem with updating to the fdroid release 2024.2.1 versionCode 9641 was that they accidentally signed the apk with a brand spanking new debug cert with a different key. Bitwarden has since re-released (note the timestamp discrepancies of the assets on Github) the fdroid version with a higher versionCode 9705 but same versionName 2024.2.1 signed with the earlier pinned cert.

I believe this should serve as a reminder to always verify apk signatures even when using TLS connections to reputable sites, as even professional and reputable organizations make mistakes. While a mildly concerning incident this has further strengthened my appreciation for FOSS projects and their communities as I am not the only person to [notice](https://github.com/bitwarden/mobile/issues/3062) this flub.

> Correct Fdroid version com.x8bit.bitwarden-fdroid.apk  
> Signer #1 certificate DN: CN=Bitwarden, OU=IT, O=Bitwarden  
> Signer #1 certificate SHA-256 digest: de6ec91431557995297bf3e65bc80349bc603a04708160618c86bc9994171c90  
> Signer #1 certificate SHA-1 digest: 6e8701765efcf3e53a5ba136c5147f43b91e28c2  
> Signer #1 certificate MD5 digest: 5d4269ea4edc87bd222fa81f52b76642

> Regular version com.x8bit.bitwarden.apk  
> Signer #1 certificate DN: CN=Unknown, OU=Engineering, O=8bit Solutions LLC, L=Jacksonville, ST=Florida, C=US  
> Signer #1 certificate SHA-256 digest: 24e06c04c208048f19f1c993b4dda4430ea8b06db8375ea0e37b834696b9ac3a  
> Signer #1 certificate SHA-1 digest: 754185cd4cdfde598748b043048bfe59a17264c2  
> Signer #1 certificate MD5 digest: be9ec31af72b4e1b0f69a07d4c60ecbd

> **Incorrect** Fdroid version com.x8bit.bitwarden-fdroid.apk  
> Signer #1 certificate DN: CN=Android Debug, O=Android, C=US  
> Signer #1 certificate SHA-256 digest: e24f1ed95a3a8b97b146733f00f6597ddd06c68b81ca026400cd7cccc1a5af54  
> Signer #1 certificate SHA-1 digest: 7fd8778bf4d6033bab66f63d420f037c82aa5116  
> Signer #1 certificate MD5 digest: 1f524e77b10036cb0f7b9614ef1ed229

---

## Post 2 by @tarki — 2024-03-08T08:04:56Z

Updated from GitHub via Obtainium, everything went fine

---

## Post 3 by @LoSee21 — 2025-06-07T19:16:10Z

> [@Exuberant5915](#):
>
> I couldn’t update the app with either the fdroid or regular release via either Obtainium or manual Github apk downloads.

It seems like the certificate “problem” is here again. Mentioned updates are not possible.

Does somebody else get the wrong key update message?