Android 应用程序自签名证书的问题/注意事项？
我用来学习Android应用程序开发的书说：
将 Android 应用程序安装到 设备，您首先需要签署 Android 包（.pak 文件） 证书的数字签名。 然而，证书可以 自签名 -- 你不需要 从以下机构购买证书 证书颁发机构例如 威瑞信。
好的，所以我知道要将应用程序安装到设备上，任何数字签名都可以（Eclipse 的 ADT 插件已经自动为我执行此操作）。但是，我不清楚是否：
- 自签名证书是否会 足以满足 Android Market 的需求吗？
- 是否有任何问题或注意事项 如果我决定释放的话 具有自签名的应用程序 证书？
这是我第一次开始向 Android 市场发布应用程序，非常感谢您的经验丰富的回答。
谢谢。
The book I am using to learn Android app development says:
To install an Android application onto
a device, you first need to sign the
Android package (.pak file) with the
digital signature of a certificate.
The certificate, however, can be
self-signed -- you do not need to
purchase a certificate from a
certificate authority such as
VeriSign.
OK, so I understand that to install the app onto a device, any digital signature will do (The ADT plugin for Eclipse is doing this automatically for me already). But, it is unclear to me whether:
- Will a self-signed certificate
suffice for the Android Market? - Are there any problems or caveats
down the road if I decide to release
an app with a self-signed
certificate?
This is the first time ever for me to start the process of releasing an app to the Android Market and your experienced answers would be most appreciated.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
证书所做的只是验证您的身份。没有别的了。
编辑：实际上，它甚至没有验证这一点。它所验证的只是此应用程序是由具有此证书的私钥的实体制作的。它生成一个身份线索：如果没有访问相同的私钥，任何其他实体都不能声称是同一实体。
此外，某些进程/文件/用户权限与同一证书的使用相关（例如，我有多个使用同一证书签名的应用程序，即使每个应用程序是单独安装的，它们也可以打开彼此的数据库）。
编辑：根本没有关系，因为自签名证书问题基于浏览器根证书存储。在浏览器中，它们尝试进行显式信任（即使用此证书的实体由已知的根证书颁发机构验证为证书标识的实体）。对于自签名证书，证书链不会以已知的根结尾，因此任何人都可以颁发它并撒谎，而对于 Verisign/Thawte/Godaddy/其他，所提出的论点是根证书的所有者以某种方式经过验证它向其提交证书的实体实际上已被授权将自己标识为该实体。
All the cert does is validate WHO you are. Nothing else.
EDIT: actually, it doesn't even validate that. All it validates is that this app was made by the entity with the private key for this certificate. It generates an identity trail: no other entity can claim to be the same entity without access to the same private key.
In addition, some of the process/file/user permissions are tied up in the use of the same certificate (for example I have multiple apps signed with the same certificate and they can open each other's databases even though each app is separately installed).
EDIT: No relationship at all, as the self signed certificate issues are based on the browser root certificate store. In browsers they are trying to do explicit trust (i.e. the entity that is using this certificate is verified by the a known root certificate authority as the entity the certificate identifies). With self-signed certificates the cert chain doesn't end in a known root so ANYONE could have issued it and lied, while with Verisign/Thawte/Godaddy/Other the argument being made is that the owner of the root certificate in some way verified that the entity it handed the cert to is actually authorized to identify themselves as that entity.