diff --git a/api_test.go b/api_test.go
index e793251..665074e 100644
--- a/api_test.go
+++ b/api_test.go
@@ -374,7 +374,7 @@
 	bundle := bundleConfigJson{
 		Name:         uri.Path,
 		URI:          bundleUri,
-		ChecksumType: "crc-32",
+		ChecksumType: "crc32",
 	}
 	bundle.Checksum = testGetChecksum(bundle.ChecksumType, bundleUri)
 	bundleJson, err := json.Marshal(bundle)
diff --git a/bundle.go b/bundle.go
index 8d03074..ccc72e0 100644
--- a/bundle.go
+++ b/bundle.go
@@ -2,6 +2,8 @@
 
 import (
 	"crypto/md5"
+	"crypto/sha256"
+	"crypto/sha512"
 	"encoding/base64"
 	"encoding/hex"
 	"errors"
@@ -14,6 +16,7 @@
 	"net/url"
 	"os"
 	"path"
+	"strings"
 	"time"
 )
 
@@ -201,7 +204,7 @@
 
 	// todo: add authentication - TBD?
 
-	// assume it's a file if no scheme
+	// assume it's a file if no scheme - todo: remove file support?
 	if uri.Scheme == "" || uri.Scheme == "file" {
 		f, err := os.Open(uri.Path)
 		if err != nil {
@@ -228,15 +231,21 @@
 
 	var hashWriter hash.Hash
 
-	switch hashType {
+	switch strings.ToLower(hashType) {
+	case "":
+		// todo: remove empty checksum support?
+		hashWriter = fakeHash{md5.New()}
 	case "md5":
 		hashWriter = md5.New()
-	case "crc-32":
+	case "crc32":
 		hashWriter = crc32.NewIEEE()
+	case "sha256":
+		hashWriter = sha256.New()
+	case "sha512":
+		hashWriter = sha512.New()
 	default:
-		// todo: temporary - this disables checksums until server implements (XAPID-544)
-		hashWriter = fakeHash{md5.New()}
-		//return nil, errors.New("checksumType must be md5 or crc-32")
+		return nil, errors.New(
+			fmt.Sprintf("invalid checksumType: %s. valid types: md5, crc32, sha256, sha512", hashType))
 	}
 
 	return hashWriter, nil
diff --git a/bundle_test.go b/bundle_test.go
index fd2be63..88f83b7 100644
--- a/bundle_test.go
+++ b/bundle_test.go
@@ -30,7 +30,6 @@
 					time.Sleep(1 * time.Second)
 					w.WriteHeader(500)
 				} else {
-					//proceed <- true
 					w.Write([]byte("/bundles/longfail"))
 				}
 			}))
@@ -48,8 +47,8 @@
 				ID:                 deploymentID,
 				DataScopeID:        deploymentID,
 				BundleURI:          uri.String(),
-				BundleChecksum:     testGetChecksum("crc-32", uri.String()),
-				BundleChecksumType: "crc-32",
+				BundleChecksum:     testGetChecksum("crc32", uri.String()),
+				BundleChecksumType: "crc32",
 			}
 
 			err = InsertDeployment(tx, dep)
@@ -70,7 +69,125 @@
 			Expect(d.ID).To(Equal(deploymentID))
 		})
 
-		It("should timeout deployment, mark status as failed, then finish", func() {
+		It("should download correctly with sha256", func() {
+			uri, err := url.Parse(testServer.URL)
+			Expect(err).ShouldNot(HaveOccurred())
+			uri.Path = "/bundles/longfail"
+			checksum := testGetChecksum("sha256", uri.String())
+
+			tx, err := getDB().Begin()
+			Expect(err).ShouldNot(HaveOccurred())
+
+			deploymentID := "bundle_download_succeed"
+			dep := DataDeployment{
+				ID:                 deploymentID,
+				DataScopeID:        deploymentID,
+				BundleURI:          uri.String(),
+				BundleChecksum:     checksum,
+				BundleChecksumType: "sha256",
+			}
+
+			err = InsertDeployment(tx, dep)
+			Expect(err).ShouldNot(HaveOccurred())
+
+			err = tx.Commit()
+			Expect(err).ShouldNot(HaveOccurred())
+
+			queueDownloadRequest(dep)
+
+			var listener = make(chan deploymentsResult)
+			addSubscriber <- listener
+			result := <-listener
+
+			Expect(result.err).NotTo(HaveOccurred())
+			Expect(len(result.deployments)).To(Equal(1))
+			d := result.deployments[0]
+			Expect(d.ID).To(Equal(deploymentID))
+		})
+
+		It("should download correctly with sh512", func() {
+			uri, err := url.Parse(testServer.URL)
+			Expect(err).ShouldNot(HaveOccurred())
+			uri.Path = "/bundles/longfail"
+			checksum := testGetChecksum("sha512", uri.String())
+
+			tx, err := getDB().Begin()
+			Expect(err).ShouldNot(HaveOccurred())
+
+			deploymentID := "bundle_download_succeed"
+			dep := DataDeployment{
+				ID:                 deploymentID,
+				DataScopeID:        deploymentID,
+				BundleURI:          uri.String(),
+				BundleChecksum:     checksum,
+				BundleChecksumType: "sha512",
+			}
+
+			err = InsertDeployment(tx, dep)
+			Expect(err).ShouldNot(HaveOccurred())
+
+			err = tx.Commit()
+			Expect(err).ShouldNot(HaveOccurred())
+
+			queueDownloadRequest(dep)
+
+			var listener = make(chan deploymentsResult)
+			addSubscriber <- listener
+			result := <-listener
+
+			Expect(result.err).NotTo(HaveOccurred())
+			Expect(len(result.deployments)).To(Equal(1))
+			d := result.deployments[0]
+			Expect(d.ID).To(Equal(deploymentID))
+		})
+
+		It("should download correctly with MD5 and redirects", func() {
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path == "/bundles/longfail" {
+					w.Write([]byte("/bundles/longfail"))
+				} else {
+					http.Redirect(w, r, "/bundles/longfail", 302)
+				}
+			}))
+			defer ts.Close()
+
+			uri, err := url.Parse(ts.URL)
+			Expect(err).ShouldNot(HaveOccurred())
+			uri.Path = "/bundles/longfail"
+			checksum := testGetChecksum("MD5", uri.String())
+			uri.Path = "/bundles/redirect"
+
+			tx, err := getDB().Begin()
+			Expect(err).ShouldNot(HaveOccurred())
+
+			deploymentID := "bundle_download_succeed"
+			dep := DataDeployment{
+				ID:                 deploymentID,
+				DataScopeID:        deploymentID,
+				BundleURI:          uri.String(),
+				BundleChecksum:     checksum,
+				BundleChecksumType: "MD5",
+			}
+
+			err = InsertDeployment(tx, dep)
+			Expect(err).ShouldNot(HaveOccurred())
+
+			err = tx.Commit()
+			Expect(err).ShouldNot(HaveOccurred())
+
+			queueDownloadRequest(dep)
+
+			var listener = make(chan deploymentsResult)
+			addSubscriber <- listener
+			result := <-listener
+
+			Expect(result.err).NotTo(HaveOccurred())
+			Expect(len(result.deployments)).To(Equal(1))
+			d := result.deployments[0]
+			Expect(d.ID).To(Equal(deploymentID))
+		})
+
+		It("should timeout deployment, mark status as failed, then finish using crc32", func() {
 
 			proceed := make(chan bool)
 			failedOnce := false
@@ -97,7 +214,7 @@
 			bundle := bundleConfigJson{
 				Name:         uri.Path,
 				URI:          bundleUri,
-				ChecksumType: "crc-32",
+				ChecksumType: "crc32",
 			}
 			bundle.Checksum = testGetChecksum(bundle.ChecksumType, bundleUri)
 			bundleJson, err := json.Marshal(bundle)
@@ -208,7 +325,7 @@
 			bundle := bundleConfigJson{
 				Name:         uri.Path,
 				URI:          bundleUri,
-				ChecksumType: "crc-32",
+				ChecksumType: "crc32",
 			}
 			bundle.Checksum = testGetChecksum(bundle.ChecksumType, bundleUri)
 			bundleJson, err := json.Marshal(bundle)
@@ -263,8 +380,8 @@
 			// search logs for "never mind, deployment bundle_download_deployment_deleted was deleted"
 		})
 
-		// todo: temporary - this tests that checksum is disabled until server implements (XAPID-544)
-		It("should TEMPORARILY download even if empty Checksum and ChecksumType", func() {
+		// todo: remove empty checksum support?
+		It("should download even if empty Checksum and ChecksumType", func() {
 
 			deploymentID := "bundle_download_temporary"
 
diff --git a/listener_test.go b/listener_test.go
index 33ebd41..0c79f3f 100644
--- a/listener_test.go
+++ b/listener_test.go
@@ -30,7 +30,7 @@
 			bundle1 := bundleConfigJson{
 				Name:         uri.Path,
 				URI:          bundleUri,
-				ChecksumType: "crc-32",
+				ChecksumType: "crc32",
 			}
 			bundle1.Checksum = testGetChecksum(bundle1.ChecksumType, bundleUri)
 			bundle1Json, err := json.Marshal(bundle1)
@@ -92,7 +92,7 @@
 			bundle := bundleConfigJson{
 				Name:         uri.Path,
 				URI:          bundleUri,
-				ChecksumType: "crc-32",
+				ChecksumType: "crc32",
 			}
 			bundle.Checksum = testGetChecksum(bundle.ChecksumType, bundleUri)
 
@@ -243,7 +243,7 @@
 			bundle := bundleConfigJson{
 				Name:         uri.Path,
 				URI:          bundleUri,
-				ChecksumType: "crc-32",
+				ChecksumType: "crc32",
 			}
 			bundle.Checksum = testGetChecksum(bundle.ChecksumType, bundleUri)
 			bundle1Json, err := json.Marshal(bundle)