Android certificate expires ?!

[Douglas McCarroll]

Hi All,

In order to publish a mobile AIR app to the Google Play Store we have to package it with a certificate.

Then when we update the app with a new version, the Play Store requires that it be signed with the same certificate.

But certificates - whether commercial or self-signed - expire.

For example, this page ...

Adobe AIR * Creating a self-signed certificate with ADT

... explains that "you will be unable to produce an updated AIR file after the original ADT-generated certificate expires ...  You can publish new applications with a different certificate, but not new versions of the same application"

I find it difficult to believe, but it almost sounds as though, when I want to update my app, I have to remove it from the Play Store and replace it with a "new application", i.e. the same app, but signed with a new certificate.

This makes no sense...

Could someone explain to me what I'm missing here?

Thanks,

Douglas

[Colin Holgate]

One requirement of Google Play is that the certificate should last at least 25 years. So, although you may hit the problem you describe, you have a long time to be mentally prepared for it.

[Douglas McCarroll]

Hi Colin,

> One requirement of Google Play is that the certificate should last at least 25 years.

Yes, I've just been reading about that, here: Sign Your App | Android Studio

But I have the impression that self-signed certificates expire after a year or two...   ?

So, perhaps the correct question for me to ask is "where/how do I obtain such a long-lived certificate?"

Douglas

[Colin Holgate]

I have only ever submitted apps with self signed certificates. When you create the certificate in Adobe Animate the Validity Period defaults to 25 years. I've never bothered to decrease or increase that.

More interesting information in the answer posted here:

android - Why should I Sign my Application APK before release - Stack Overflow

[Douglas McCarroll · Accepted solution]

Thanks Colin - That was the guidance that I needed. I don't use Animate, but once I knew that it was possible to create a certificate with a long validity period I used ADT to create it.

Here's the command I used, if anyone is interested:

adt -certificate -cn SelfSign -ou QE -o "My Organization's Name" -c US -validityPeriod 30 2048-RSA MyFileName.p12 myPassword

Adobe AIR * AIR Developer Tool (ADT)

[Colin Holgate]

I marked your post as being the correct answer, because for people coming here (who also may not use Animate), what you wrote will get them started.

[rewb0rn]

Its actually possible to create certifcates with a way higher validity. If you want to be sure that your game will be playable in the year 4000, you can use this Java keytool command:

keytool -genkey -v -keystore %CERT_FILE% -alias %CERT_NAME% -keyalg RSA -keysize 2048 -validity 1000000 -storetype pkcs12 -storepass %CERT_PASS%

It feels much better than 25 years, trust me

[Douglas McCarroll]

Thanks, rewb0rn.

But I'm a command line newbie...  When I run that I get this:

-bash: call: command not found

What am I not understanding? 

[rewb0rn]

Sorry I have removed the "call", it is only needed when executing the command from a .bat file.

[Douglas McCarroll]

Thanks rewb0rn - this seems to work. I haven't submitted my app to Play Store yet, but I think that I'm set for the next century as far as my certificate is concerned.