What is an Android Code Signing Certificate?

Here’s something you may not know: cell phone apps are great way to spread malware. It turns out that enterprising hackers realized early on during the app craze that the general populace is overly trusting and will happily download and give full permissions to an unknown app just so they can put down location pins at every place they visit. This is where an “Android code signing certificate” can come in handy for Android app developers.

Fortunately, the smart phone OS makers, both Apple with its iOS and Google with its Android platform, have tighten up the oversight of apps on their systems, warning users about unknown downloads and regulating what shows up in their app stores.

Nowadays, if you want to sell your wares on the app stores, you have to sign your app with a trusted code signing certificate. For Android developers, that means getting an Android code signing certificate.

What is an Android Code Signing Certificate?

Note: There’s no such thing as an Android code signing certificate. In reality, you’re just purchasing a configuration of an X.509 digital certificate and using its cryptographic key. The difference is that you’re using a standard code signing certificate for an Android-specific client to sign your Android code as opposed to, say, an Authenticode client or an Adobe one.

Code signing works like this: When you’re ready to sign your software, you open your Android signing client. With just a few clicks, your code will undergo a complex cryptographic process:

1. The entire piece of software is hashed. Hashing a function that maps input of any length into a fixed-length output. It’s essentially a one-way function and serves as a checksum during the code signing process.
2. Following the hash function, the code signing certificate’s private key is used to sign the hash value, and then both are hashed together. With hashing, no two disparate inputs can result in the same output, so even the smallest change will alter the hash value that’s created.

This is what lets the end user’s system verify the software and the signature affixed to it. When the user receives the software, their device will use the public key associated with the certificate to verify the signature, then it will run the same hash functions to make sure they produce the same values.

As long as it all checks out, your software will be trusted. If not, the user’s device will issue an error warning.

Do I Need a Code Signing Certificate?

Yes, you need a code signing certificate if you want your software to be trusted. Signing your code is compulsory for any developer that wants to have their applications included in the Google Play Store, which is the Android app storefront. Not having your app included makes it infinitely harder to get people to download.

It also means that Android devices will warn their users about the potentially dubious origins of your app before they can install it. A lot of people are loathe to click through these types of warnings on account of the fact they trust Google and their device.

The easy answer is just to sign your code. Code signing certificates are affordable and easy to get. In fact, we’ve got a few right here…