Confirming the validity/ownership of a Android Signing Certificate

Question

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate.

Is there a way to query google for their approved signing certificates to check the validity?

- Issuer: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
- Serial number: c2e08746644a308d
- Valid from: Thu Aug 21 17:13:34 MDT 2008 until: Mon Jan 07 16:13:34 MST 2036
- Certificate fingerprints:
- SHA1: 38:91:8A:45:3D:07:19:93:54:F8:B1:9A:F0:5E:C6:56:2C:ED:57:88
- SHA256: F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83
- Signature algorithm name: MD5withRSA (weak)
- Subject Public Key Algorithm: 2048-bit RSA key
- Version: 3

Answer 1

It's always easier if you could get actual certificate in form of X.509 file(PEM or DER). I've found apps signed by your certificate here: https://www.apkmirror.com/?s=F0FD6C5B410F25CB25C3B53346C8972FAE30F8EE7411DF910480AD6B2D60DB83 But due to new APK signing scheme full certificate is not present. It still although possible to get more details:

apksigner verify --print-certs --verbose file.apk | grep Signer
Signer #1 certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Signer #1 certificate SHA-256 digest: f0fd6c5b410f25cb25c3b53346c8972fae30f8ee7411df910480ad6b2d60db83
Signer #1 certificate SHA-1 digest: 38918a453d07199354f8b19af05ec6562ced5788
Signer #1 certificate MD5 digest: cde9f6208d672b54b1dacc0b7029f5eb
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 2b06490d2d24305c6a90dbf74cc42f50183d207d572f8079e5d92fb2c2a0cda1
Signer #1 public key SHA-1 digest: b2da9ef7ec0f4474117fb0cba4dca3b795c0eab7
Signer #1 public key MD5 digest: a90ce510a96aa09bee6bf8d9da9b258b
Source Stamp Signer certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Source Stamp Signer certificate SHA-256 digest: 3257d599a49d2c961a471ca9843f59d341a405884583fc087df4237b733bbd6d
Source Stamp Signer certificate SHA-1 digest: b1af3a0bf998aeede1a8716a539e5a59da1d86d6
Source Stamp Signer certificate MD5 digest: 577b8a9fbc7e308321aec6411169d2fb
Source Stamp Signer key algorithm: RSA
Source Stamp Signer key size (bits): 4096
Source Stamp Signer public key SHA-256 digest: 4c53c1d28f2ecceadcb1351603f0b702615b3454b6e30070de759359f241b802
Source Stamp Signer public key SHA-1 digest: 188b067a9ee881bde55dabe0f8f7ecb320b1a091
Source Stamp Signer public key MD5 digest: 965afac83f033aa037a54482eb6922d5

Then you can Google other hashes to confirm it's most likely legitimate but only Google can definiately confirm this and this specific certificate is not present in Certificate Transparency lists so it seems they intentionally avoid this