Self-Sign Your Appbundles

Updated on 15. August 2021 by Jan Bunk


Image with text: Generating Keys & Signing Your App Yourself

For maximum security and flexibility we can provide our enterprise customers unsigned versions of their Android app, so they can sign them themselves.

This guide requires some technical proficiency to install the necessary programs and use the commandline. If it's too complex, we can also sign the app regularly ourselves and send you the keys afterwards.

Prerequisites

  • jarsigner
    This is included with the Java Developer Kit (JDK), but not the Java Runtime Environment (JRE). You can easily find and install recent versions of the JDK using AdoptOpenJDK
  • keytool
    Also included in the JDK.

Generating Keys

If you don't have any signing keys yet, you can generate them like this.

keytool -genkey -noprompt -v -keystore {key_file_name}.jks -storetype JKS -keyalg RSA -keysize 2048 -validity 99999 -alias {key_alias} -dname "OU=IT, O={organization}" -storepass {storepass} -keypass {keypass}
  • key_file_name
    Example: key0

    You can use any name for the key file. Preferably only use ASCII characters and digits though to be safe.

  • key_alias
    Example: key0

    You can use any alias, I usually keep it simple by naming it the same as the key file. Preferably only use ASCII characters and digits though to be safe.

  • organization
    Example: webtoapp.design

    The name of your company.

  • storepass
    Example: LWRrjdrnXW1NSYzUDLHkaa5uCesmELE

    A secure password for your keystore.

  • keypass
    Example: SYspVNgpUbintxdZrlKPx3vfYBvP7wd

    A secure password for your key

Signing an Unsigned Appbundle

jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -keystore {key_file_name}.jks -keypass {keypass} -storepass {storepass} {bundle_name}.aab {key_alias}

Most variables here are from the previous step.

  • bundle_name
    Example: app-release

    The file name of the unsigned app bundle we sent you.

    Don't have your app bundle yet? Download your app bundle here

You can verify the signature with the following command. You can ignore the warning that you used a self-signed certificate.

jarsigner -verify {bundle_name}.aab

Uploading the Appbundle

You can just continue with the regular Android app publishing guide.

When you get to the app uploading section, just upload the app bundle you just signed.

Related Articles


Image with text: Staying Compliant with Export Regulations

Export Compliance in the App Store & Play Store

You need to pay attention to some export regulations because apps count as encryption software and app downloads count as exporting the app from the USA.

Image with text: Inviting Us to Your Google Developer Account

Granting us Access to Your Google Developer Account for Support

Developer accounts are needed to publish your app. Find out how you can grant us access to yours in case you want us to help you with something.

Image with text: Publishing Your App in the Amazon App Store

Filling in the Information to Get Your App Published in Amazon's App Store

Publishing your Android app in the Amazon App Store is free and very easy compared to publishing it in the Google Play Store or Apple App Store.


Author Jan Bunk
Written by
Jan Bunk

This website is operated by me, Jan, and my team. I have previously developed a bunch of apps for clients and my own projects. Back in 2019 I noticed that none of the existing website to app converters provide the kind of service I'd expect as a customer. That inspired me to develop a better solution - webtoapp.design. By now, the apps I've created with my team have already been downloaded hundreds of thousands of times from the app stores.