93

I have to upload a new application, It's just the design that's a little different. Yesterday I generated the keystore file to sign application. Can I use the same?

onexf
  • 3,244
  • 3
  • 20
  • 34
Raluca Lucaci
  • 1,868
  • 2
  • 17
  • 35

7 Answers7

101

You can use that keystore for any number of applications.

No need to generate a new keystore.

Will Eddins
  • 12,890
  • 5
  • 46
  • 83
Chirag
  • 55,270
  • 29
  • 150
  • 194
  • 6
    And for 'Alias', what should i write? – Dr.jacky Feb 10 '15 at 12:23
  • 15
    A keystore *CONTAINS* the public/private keypairs that make up a signing certificate. One keystore can contain many keypairs. An 'alias' is a reference to a particular keypair in the keystore. One keystore can hold all of your keypairs, but you should have one keypair per app. Use the name of the app you are signing as the alias. You can have separate passwords for your keystore and for each keypair within it. You can change these passwords and import/export keypairs from the keystore or add new keypairs to your keystore. This is all done with the command line 'keytool' command. Look it up. – brycewjohnson Feb 11 '17 at 00:41
  • @brycewjohnson Can new pairs be added to the keystore via a GUI? – CinCout Mar 14 '18 at 19:43
46

I'll make a counter argument to the consensus answer so far.

I agree that for most app authors most of the time, sharing the same keystore/certificate/password between your apps will work fine. The critical thing is to use "the same certificate throughout the expected lifespan of your applications" so the app can upgrade itself.

But I can think of one very good reason to have separate keystores for separate apps or families of apps. If you think you might ever want to sell an app to someone else for them to publish as an upgrade to the original, you'll have to share your one-and-only keystore and password with them to do so. Probably not a huge issue but a bit of worry to you and, perhaps, a due diligence issue to a big-enough buyer.

Also, I really don't read the same line in the documentation the same way as @ol_v_er does. I think the current line:

You should sign all of your apps with the same certificate throughout the expected lifespan of your applications.

(note the lack of a comma in the current version) is simply emphasizing that the 'lifetime' recommendation applies to all apps, not actually directing you to use the same certificate for all of your apps.

Sufian
  • 5,997
  • 14
  • 60
  • 111
Anne Gunn
  • 2,134
  • 1
  • 26
  • 38
  • 6
    Keeping separate keystores for each app should be the way to go! – Sufian Oct 13 '16 at 14:49
  • The recommendation is to use a different file for each app, right? What happens if you use the same keystore file for more than one app, though? It seems to cause some issues with Firebase/Google services. I guess it's impossible to use a new one (a different one for each app) if it's already done, right? – android developer Dec 21 '20 at 10:47
44

The official documentation tells us:

In general, the recommended strategy for all developers is to sign all of your applications with the same certificate, throughout the expected lifespan of your applications. There are several reasons why you should do so ...

https://developer.android.com/studio/publish/app-signing.html#considerations

So yes, try to sign all of your applications with the same certificate.

Jesús Carrera
  • 10,611
  • 4
  • 59
  • 55
ol_v_er
  • 25,694
  • 6
  • 44
  • 61
22

I want to add some clarification here, because this question and the answers provided lead to confusion for me. It is crucial to understand what a keystore actually is.

A keystore is just a means to securely store the public/private key pair which is used to sign your Android apks. So yes, you can use the same keystore to sign multiple apks, without a problem. You can also use the same alias (each alias is a certificate) to sign multiple apks, and it will work. It has security implications, however. If your single alias is compromised, then all of your apps will have been compromised.

However, if you intend to sell the rights to your apps one day, then using the same alias for all of your apps may not be a good idea. However, using the same keystore, provided you use a different alias for each apk, may not necessarily be a bad option. I'm sure there is a way that you can move a certificate from one keystore to another, so that you can securely give the necessary keys for only that certificate to your buyer.

To make it very clear, a keystore is just that, a storage medium for keys. It plays no actual part in the process of signing an apk, but only serves to store the keys which are actually used to sign the apk.

References:

Understanding keystore, certificates and alias

https://www.digitalocean.com/community/tutorials/java-keytool-essentials-working-with-java-keystores

Community
  • 1
  • 1
Anthony Stivers
  • 356
  • 2
  • 10
  • 1
    Please don't post identical answers to multiple questions. Post one good answer, then vote/flag to close the other questions as duplicates. If the question is not a duplicate, *tailor your answers to the question.* – Paul Roub May 11 '16 at 21:52
  • Apologies. I'm a noob to SO. – Anthony Stivers May 11 '16 at 22:21
  • 1
    I don't have enough rep to vote for a duplicate. So if you would like to vote the following questions as duplicates, I feel this question is the most appropriate to be the non-duplicate. It is the first rank in Google for the relevant keywords, and has the most relevant answers. http://stackoverflow.com/questions/13023509/same-keystore-for-different-app/ http://stackoverflow.com/questions/14973205/android-can-publish-different-apps-with-same-keystore-file-in-multiple-account/ http://stackoverflow.com/questions/10514597/android-multiple-apps-multiple-customers-one-keystore/ – Anthony Stivers May 11 '16 at 22:26
  • Wait! How can I use the same keystore but with different alias for each app?! – Ziad H. Apr 05 '20 at 01:31
5

Of course! You can use the same keystore file as many times you want. It's always better to use the same keystore file for all the applications you develop. That will help if you want to update or modify the application. At that time you need to sign your application with the same key.

Nikola Malešević
  • 1,563
  • 4
  • 17
  • 39
Rohit
  • 563
  • 2
  • 8
3

I do sign all my apps using the same certificate (keystore). This gives an advantage if i change my mind and want my apps to share their data.

As you might know Android identifies each app with an UID. If all your apps are signed by the same certificate you can request android to assign same user id more than one app and inturn make them run in a single process and share the data.

From android doc android:sharedUserId

android:sharedUserId

The name of a Linux user ID that will be shared with other applications. By default, Android assigns each application its own unique user ID. However, if this attribute is set to the same value for two or more applications, they will all share the same ID — provided that they are also signed by the same certificate. Application with the same user ID can access each other's data and, if desired, run in the same process

Community
  • 1
  • 1
sujith
  • 2,311
  • 2
  • 15
  • 25
2

Recent Update

If you want to enrol in App signing by google you have to use new different key to sign your apk or bundle otherwise after uploading google console will give you error message saying

You uploaded an APK or Android App Bundle that is signed with a key that is also used to sign APKs that are delivered to users. Because you are enrolled in App Signing by Google Play, you should sign your APK or Android App Bundle with a new key before you upload it

Riya Parmar
  • 111
  • 1
  • 3
  • I was able to generate a new key inside android studio apk signing screen. Generate new keystore and alias and it may work. It worked for me. – Numan Karaaslan Nov 01 '20 at 10:28