How do I Create a Self-Signed Certificate for an Android App?
This lesson describes how to create a self-signed certificate for your Android application. Variations between Apple Mac and Windows are discussed and screen captures are provided.
Introduction
The Android release system requires that all applications installed on user devices are digitally signed with certificates whose private keys are held by the developer of the applications. The certificates allow the Android system to identify the author of an application and establish trust relationships between developers and their applications. The certificates are not used to control which applications the user can and cannot install.
There are 2 ways to create a certificate for an Android app:
1. Using the "keytool" application from the Terminal
2. Using Android Studio
How to create a certificate using the "keytool" application from the Terminal
Locating Keytool
Keytool is a key generation application that is made available through your Java SDK installation. You should be able to access the tool using a Terminal on your Mac or through the Command Prompt on your Windows machine.
The location of keytool is included in the directory search path on standard Mac installations but may have to be configured on Windows machines.
You can typically find the keytool application in the following or similar location under windows: C:\Program Files\Java\jdk1.6.0_24\bin\, if you followed the default installation process. You can either run keytool.exe from this location or add the relevant path to your search paths.
To add the path to your existing search paths, open your Control Panel and navigate to System and Security -> System -> Advanced system settings. This opens the System Properties window with the Advanced tab. Select Environment Variables... to open the Environment Variables window. Then select Path from the System variables panel and select Edit... . This opens the Edit System Variable dialog in which you can add the new path to the existing list of search paths. Make sure that you separate each new path with a semicolon, as is shown in the figure of this step.
Creating the Key
Open your Terminal or Command Prompt and execute the command keytool. If the application is found, it is executed and a list of the available command line options is returned. This provides you with information on how you can configure the key generation process. The following example should allow you to generate an appropriate key:
keytool.exe -genkey -v -keystore release.keystore -alias TicTacToe -keyalg RSA -keysize 2048 -validity 10000
The application is interactive and command line driven, requesting that you enter a number of parameters. Do not worry if you make mistakes when entering parameters, you can enter them again.
Once you have created your key, it is stored in a .keystore file with its location shown at the end of the output, generated by the keytool. You should make a copy of your .keystore and keep it and the passwords in a safe place.
Note: -alias TicTacToe is specific to an application that is being signed in a latter lesson. You may want to change this to something that is more meaningful to the application you are working on.
How to create a certificate using Android Studio
To create a signing certificate using Android Android Studio, follow these steps:
1. Create a new empty project and click on Build -> Generate Signed Bundle/APK...
2. In the Generate Signed Bundle or APK dialog, select either Android App Bundle or APK and click Next.
3. Select a module from the drop down. In this case, you should only see "MyApplication1.app", which is the default name for the empty project you have created.
4. Below the field for Key store path, click Create new.
On the New Key Store window, provide the following information for your keystore and key:
- Keystore
Key store path: Select the location where your keystore should be created.
Password: Create and confirm a secure password for your keystore.
- Key
Alias: Enter an identifying name for your key.
Password: Create and confirm a secure password for your key. This should be different from the password you chose for your keystore.
Validity (years): Set the length of time in years that your key will be valid. Your key should be valid for at least 25 years, so you can sign app updates with the same key through the lifespan of your app.
Certificate: Enter some information about yourself for your certificate. This information is not displayed in your app, but is included in your certificate as part of the APK.
Once you complete the form, click OK.
Note: Android Studio might or might not append the .keystore extension to the name of the newly created certificate. If not, you can just rename the file later and add the .keystore extension
You have now created the signing key, in the "Key Store Path" location. Make sure you write down all the passwords as well as the alias, and keep them in a safe place. You will need them for signing the android standalone app, as seen in the next lesson.
Once you have a working key, go to lesson: How do I Create an Android App for Distribution? to find out how to sign your application.
Note: The Android website: https://developer.android.com/studio/publish/app-signing#sign_release has a lot of information and recommendations on how to create your private key. It is strongly recommended that you review that information in addition to what is covered in this lesson.
Just for reference: If you are on a Mac, use "keytool" as the command, not "keytool.exe". Also, if your app is more than one word, you must enclose the alias name in quotes or the shell command will hang.