Sign here, please!
summary
Covers how Android app identity rests on certificates and keystores and gives concrete steps: generate keys with keytool and apksigner, choose Android KeyChain (API 14) or Android Keystore (API 18+), check hardware binding via KeyInfo (API 23), and use Google Play app signing to offload private-key custody and enable upload-key revocation. Explains certificate chains, LetsEncrypt vs CAs, API-level limits (key rotation and StrongBox keymaster only on newer devices), and recommends auditing TLS with Qualys SSL Labs.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 9:10Certificate Authority
- 13:10Google Certificate Authority
- 14:35Chain of Trust
- 16:50Are we safe
- 22:05Signing Android applications
- 26:15People spill coffee
- 29:30Google App Signing
- 31:32Should you use the same key
- 33:43UML diagram
- 35:49Keychain vs Keister
- 37:57Generator
- 39:03Keystore
- 41:09Android PI
